ACL Identity & Access Management 2 — Questions and Answers
Question 1: In a role-based access control (RBAC) model, what is the primary mechanism used to assign permissions to users?
- Permissions are assigned directly to each user account
- Permissions are assigned to roles, and users are assigned to roles (Correct answer)
- Permissions are determined by the user's department code in Active Directory
- Permissions are inherited from the operating system's default settings
Correct answer: Permissions are assigned to roles, and users are assigned to roles
In RBAC, permissions are attached to roles rather than individual users, and users gain permissions by being assigned to appropriate roles.
Question 2: Which IAM concept ensures that no single user has enough privileges to complete a sensitive transaction alone?
- Least privilege
- Separation of duties (Correct answer)
- Need-to-know
- Account lockout
Correct answer: Separation of duties
Separation of duties requires that critical tasks be split among multiple users to prevent fraud or error by any one individual.
Question 3: What does the term 'provisioning' refer to in identity management?
- Revoking access when an employee leaves
- The process of creating and assigning user accounts and access rights (Correct answer)
- Auditing user activity logs for compliance
- Encrypting user credentials in a directory
Correct answer: The process of creating and assigning user accounts and access rights
Provisioning is the process of setting up user identities and granting them the appropriate access rights to systems and resources.
Question 4: An ACL entry that grants access to a specific IP range while denying all others follows which security principle?
- Default allow
- Implicit deny
- Explicit allow with implicit deny (Correct answer)
- Discretionary access
Correct answer: Explicit allow with implicit deny
Explicitly allowing only a defined IP range and relying on an implicit deny at the end of the ACL combines explicit allow with implicit deny.
Question 5: Which authentication factor category does a hardware security token (e.g., RSA SecurID) belong to?
- Something you know
- Something you have (Correct answer)
- Something you are
- Something you do
Correct answer: Something you have
A hardware token is a physical device the user possesses, placing it in the 'something you have' authentication category.
Question 6: What is the primary purpose of an Identity Provider (IdP) in a federated identity system?
- To store user passwords in an encrypted database
- To authenticate users and assert their identity to service providers (Correct answer)
- To authorize access to specific application features
- To monitor network traffic for unauthorized access attempts
Correct answer: To authenticate users and assert their identity to service providers
An IdP authenticates users and issues identity assertions (tokens or assertions) that other service providers trust.
Question 7: Which of the following best describes 'just-in-time' (JIT) access provisioning?
- Accounts are created during onboarding and never modified
- Privileged access is granted only when needed and automatically revoked afterward (Correct answer)
- Users request access and receive it within 24 hours
- Access is granted based on time-of-day ACL rules
Correct answer: Privileged access is granted only when needed and automatically revoked afterward
JIT provisioning provides elevated or privileged access on-demand for a defined window, then automatically removes it to minimize standing privilege.
ACL Identity & Access Management 2
In a role-based access control (RBAC) model, what is the primary mechanism used to assign permissions to users?