ACL Identity & Access Management 3 â Questions and Answers
Question 1: In a mandatory access control (MAC) system, who controls access to resources?
- The resource owner sets all access policies
- End users can grant access to peers as needed
- A central authority enforces policy based on classification labels (Correct answer)
- Access is determined by group membership in Active Directory
Correct answer: A central authority enforces policy based on classification labels
MAC systems rely on a central authority that enforces access based on security labels and classifications, not individual owner discretion.
Question 2: What is an 'orphan account' in the context of identity lifecycle management?
- An account shared among multiple users for administrative tasks
- A user account that remains active after the associated employee has left the organization (Correct answer)
- An account with no password set
- A guest account created for temporary contractor access
Correct answer: A user account that remains active after the associated employee has left the organization
Orphan accounts are active user accounts that are no longer associated with a current employee, creating a security risk if not deprovisioned.
Question 3: Which protocol is most commonly used to query and manage directory services for user authentication in enterprise environments?
- RADIUS
- LDAP (Correct answer)
- SAML
- OAuth
Correct answer: LDAP
LDAP (Lightweight Directory Access Protocol) is the standard protocol for accessing and maintaining directory information such as user accounts.
Question 4: A user can read a file but cannot modify it. Which type of permission has been applied?
- Execute-only permission
- Read-only permission (Correct answer)
- Write permission with audit
- Deny-all with read exception
Correct answer: Read-only permission
Read-only permission allows a user to view the contents of a file but prevents any modifications.
Question 5: What is 'privilege creep' in identity and access management?
- A sudden spike in privileged account usage detected by SIEM
- The gradual accumulation of access rights beyond what a user currently needs (Correct answer)
- An exploit that escalates a standard user to administrator
- The practice of logging all privileged user activities
Correct answer: The gradual accumulation of access rights beyond what a user currently needs
Privilege creep occurs when users accumulate access rights over timeâoften through role changesâwithout removing previously granted permissions.
Question 6: Which IAM control is specifically designed to verify that user access rights remain appropriate over time?
- Multi-factor authentication
- Access certification (user access review) (Correct answer)
- Single sign-on
- Password complexity policy
Correct answer: Access certification (user access review)
Access certification is a periodic review process where managers verify that users still need and are authorized for their current access rights.
Question 7: In attribute-based access control (ABAC), access decisions are made based on which of the following?
- Only the user's group membership
- Attributes of the user, resource, environment, and action being requested (Correct answer)
- The discretion of the resource owner at time of request
- Predefined role assignments stored in a central database
Correct answer: Attributes of the user, resource, environment, and action being requested
ABAC evaluates multiple attributesâuser attributes, resource attributes, environmental conditions, and the actionâto make fine-grained access decisions.
ACL Identity & Access Management 3
In a mandatory access control (MAC) system, who controls access to resources?