CCNA Cissp IAM Questions

PKCE (Proof Key for Code Exchange) is designed for public clients to prevent interception of the authorization code.

Role-Based Access Control (RBAC) uses roles that group permissions according to job functions.

Separation of Duties (SoD) is a control that prevents a single individual from performing conflicting duties, reducing the risk of fraud.

Recertification should confirm business need, review actual access, and be periodic.

Type 3 factors are biometrics: fingerprint and retina scan.

Two-person control (D) is a best practice for preventing fraud because it requires two authorized individuals to perform a critical action, such as approving a high-value transaction or accessing a sensitive system. This ensures collusion is needed to commit fraud, as no single person can complete the action alone. In a financial application, this might involve dual approval for wire transfers over a threshold, directly mitigating insider threats.

The Identity Provider (IdP) authenticates users and creates assertions containing authentication/attribute/authorization data.

Authorization code and client credentials are standard OAuth 2.0 grant types.

Attribute-Based Access Control (ABAC) uses attributes and policies to grant access, offering fine-grained control.

SAML uses XML-based assertions and can be initiated by the Identity Provider (IdP-initiated) or Service Provider (SP-initiated).

SAML 2.0 is XML-based and uses browser redirects for SSO between IdP and SPs.

A smart card is a Type 2 authentication factor because it falls under the 'something you have' category. The card itself is a physical device that stores a digital certificate or cryptographic key, which the user must possess to authenticate. Unlike knowledge-based or biometric factors, possession of the smart card is the core authentication mechanism, often combined with a PIN (Type 1) for two-factor authentication.

OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that primarily adds user authentication. While OAuth 2.0 provides authorization delegation (access tokens for resources), OIDC introduces an ID token (a JSON Web Token, JWT) that contains claims about the authenticated user, enabling the client to verify the user's identity. This is defined in the OIDC specification (OpenID Foundation) and is the key differentiator from plain OAuth 2.0.

PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks, especially for public clients like mobile apps.

A Type 2 factor is something you have, such as a smart card or OTP token.

Using two different factor types (password and hardware token) constitutes multi-factor authentication (MFA).

A golden ticket attack involves forging a TGT, but pass-the-ticket uses a legitimate TGT obtained illegally.

Separation of duties (SoD) ensures that no single individual has control over all parts of a critical process, reducing fraud risk.

The TGT is a credential that proves the user has been authenticated by the AS and is allowed to request service tickets without re-entering credentials.

An orphaned account is one that remains active after an employee has left, posing a security risk.

Discretionary Access Control (DAC) is the correct answer because it allows the data owner (the creator or custodian of the resource) to decide who can access their resources and at what privilege level. In DAC, access rights are assigned based on the owner's discretion, typically using Access Control Lists (ACLs) or owner-based permissions, as seen in file systems like NTFS or UNIX chmod.

Orphaned accounts are active accounts of former employees or unused accounts, which can be exploited to gain unauthorized access or persist undetected.

A Type 1 factor is something you know, such as a password, PIN, or security question.

A golden ticket attack involves forging a TGT using the KRBTGT account hash, granting access to any resource in the domain.

The Authorization Code grant with PKCE is designed for public clients like mobile apps to prevent interception of the authorization code.

Just-in-time (JIT) access grants privileges only when needed, reducing the attack surface from permanent privileged accounts.

PAM includes password vaulting and session recording; just-in-time access is also a characteristic, but note: the question asks for TWO, so select the correct two.

PAM typically includes password vaulting, session recording, and just-in-time access. Break-glass accounts are also a feature, but the question asks for three of the most common.

PAM typically includes password vaulting (secure credential storage), session recording (monitoring privileged sessions), and just-in-time access (elevated privileges on demand).

The Authentication Server (AS) is responsible for issuing TGTs after verifying the user's password or other credentials.

A smart card is a Type 2 authentication factor because it falls under the category of 'something you have.' Type 2 factors are possession-based, meaning the user must physically possess the token to authenticate. Smart cards store cryptographic keys or certificates and require a card reader to present the credential, making them a classic example of a possession factor.

Password is Type 1 (something you know), SMS OTP is Type 2 (something you have, as the phone is possessed). Only two factor types are used.

Discretionary Access Control (DAC) allows the resource owner to control access at their discretion.

The TGT is obtained from the AS and used to request service tickets from the TGS without re-entering credentials.

CN stands for Common Name, which typically represents the user's name or the hostname of a device.

Option B is correct because OAuth 2.0 is fundamentally an authorization framework (RFC 6749) that grants delegated access to resources, while OpenID Connect (OIDC) is an authentication layer built on top of OAuth 2.0 (specified in OpenID Connect Core 1.0) that verifies the end-user's identity. OIDC extends OAuth 2.0 by adding an ID token (a JWT) that contains claims about the authenticated user, whereas OAuth 2.0 alone does not provide identity information.

Group Policy Objects (GPOs) can be linked to an Organizational Unit (OU) containing the department's user accounts to enforce password settings.

In SP-initiated SSO, the user first tries to access the SP, which then redirects to the IdP.

SAML 2.0 is an XML-based protocol for SSO that supports both IdP and SP initiated flows and uses assertions.

OAuth 2.0 is an authorization framework that provides delegated access; it does not authenticate the user.

The Authentication Server (AS) verifies the user's credentials and issues a TGT, which the user can then use to request service tickets from the TGS.

The DN is the unique identifier for an entry in the LDAP directory, consisting of a sequence of Relative Distinguished Names (RDNs).

The principle of least privilege states that users should have the minimum level of access required.

Using two different types of factors (password - Type 1, OTP - Type 2) constitutes multi-factor authentication.

A Golden Ticket attack involves forging a TGT with the KRBTGT hash, granting unrestricted access.

Just-in-time (JIT) access provides time-limited privileges that are granted on demand, reducing the attack surface.

LDAP (Lightweight Directory Access Protocol) is used for directory services.

Separation of duties (SoD) is the principle that requires two or more individuals to complete a sensitive transaction, such as a wire transfer, to prevent fraud or error. By mandating two employees to authorize the transfer, the application ensures no single person has unchecked control over the entire process, enforcing a dual-control mechanism. This directly implements the SoD principle, which is a core access control concept in identity and access management.

SAML 2.0 and OpenID Connect (OIDC) are both SSO protocols that provide authentication and authorization. OAuth 2.0 alone provides only authorization.

OIDC uses ID token, UserInfo endpoint, and OAuth 2.0 authorization framework.

An orphaned account is a user account that remains active in the identity management system after the employee has left the organization. This creates a security risk because the account can be exploited by attackers or former employees to gain unauthorized access to systems, data, or network resources, bypassing access controls that rely on account deactivation.

The authorization code grant with PKCE (Proof Key for Code Exchange) is designed for public clients to prevent interception of the authorization code.

Deprovisioning is the process of removing user accounts and access rights when an employee leaves the organization. It directly addresses the requirement to promptly revoke all access, ensuring that the former employee cannot authenticate or authorize any actions within the system. This process typically involves disabling or deleting the user object in the directory service (e.g., Active Directory) and removing associated permissions from all resources.

Common PAM features include just-in-time access, session recording/monitoring, and password vaulting. Break-glass accounts are emergency access, not a standard feature.

Orphaned accounts can be used by former employees or attackers, and may violate compliance.

Privileged Access Management (PAM) provides just-in-time access, session recording, password vaulting, and break-glass accounts.

Access recertification (or access review) requires users or managers to verify the continued need for access rights.

The Distinguished Name (DN) uniquely identifies each entry in the LDAP directory tree.

Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both approving a transaction and reconciling the account. This reduces the risk of fraud or error by requiring collusion between two or more people to subvert a process. In a financial system, SoD is enforced through access control mechanisms that assign distinct roles (e.g., 'Transaction Approver' and 'Account Reconciler') with mutually exclusive permissions, often implemented via Role-Based Access Control (RBAC) or attribute-based policies.

An orphaned account is one that remains active after the user has left the organization, posing a security risk.