CAP Identity & Access Management 2 — Questions and Answers
Question 1: Under the RMF, which document formally establishes the boundaries of a system and identifies the individuals responsible for its security?
- System Security Plan (SSP) (Correct answer)
- Authorization to Operate (ATO)
- Plan of Action and Milestones (POA&M)
- Security Assessment Report (SAR)
Correct answer: System Security Plan (SSP)
The SSP defines the system boundary, describes controls in place, and identifies the system owner and authorizing official.
Question 2: Which NIST SP 800-63 assurance level requires proof of identity with in-person or supervised remote proofing and binding to a hardware-based authenticator?
- IAL1
- IAL2
- IAL3 (Correct answer)
- IAL0
Correct answer: IAL3
IAL3 mandates in-person or supervised remote identity proofing with a physical or biometric comparison tied to a hardware authenticator.
Question 3: A user's access to a classified database is determined solely by their job role and does not account for individual permissions. This is an example of which access control model?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC grants access based on predefined roles assigned to users rather than individual identity attributes.
Question 4: When an organization implements privileged access workstations (PAWs), what primary risk is being mitigated?
- Insider threat from disgruntled employees
- Credential theft through malware on general-use endpoints (Correct answer)
- Unauthorized physical access to server rooms
- Data exfiltration via removable media
Correct answer: Credential theft through malware on general-use endpoints
PAWs isolate privileged credentials from internet-exposed workstations, reducing the risk of credential harvesting by malware.
Question 5: Which federation protocol uses JSON Web Tokens (JWTs) to convey identity claims between an authorization server and a resource server?
- SAML 2.0
- OAuth 2.0 with OpenID Connect (Correct answer)
- Kerberos
- RADIUS
Correct answer: OAuth 2.0 with OpenID Connect
OpenID Connect layered on OAuth 2.0 uses JWTs (ID tokens) to communicate authenticated user identity claims.
Question 6: An authorizing official receives an SSP but the system owner requests waiver of a required control due to an operational constraint. What document captures this accepted risk?
- Contingency Plan
- Plan of Action and Milestones (POA&M)
- Risk Acceptance Memo (Correct answer)
- Security Assessment Plan
Correct answer: Risk Acceptance Memo
A Risk Acceptance Memo (or formal risk acceptance document) is signed by the AO to acknowledge and accept residual risk from an unimplemented control.
Question 7: Under NIST SP 800-53, which control family directly addresses user provisioning, account types, and least privilege enforcement?
- AC – Access Control (Correct answer)
- IA – Identification and Authentication
- AU – Audit and Accountability
- SC – System and Communications Protection
Correct answer: AC – Access Control
The AC control family covers account management (AC-2), least privilege (AC-6), and access enforcement across all account types.
CAP Identity & Access Management 2
Under the RMF, which document formally establishes the boundaries of a system and identifies the individuals responsible for its security?