CAP Identity & Access Management 2

Question 1

Under the RMF, which document formally establishes the boundaries of a system and identifies the individuals responsible for its security?

Accepted Answer

System Security Plan (SSP)

Answer

The SSP defines the system boundary, describes controls in place, and identifies the system owner and authorizing official.

Question 2

Which NIST SP 800-63 assurance level requires proof of identity with in-person or supervised remote proofing and binding to a hardware-based authenticator?

Accepted Answer

IAL3

Answer

IAL3 mandates in-person or supervised remote identity proofing with a physical or biometric comparison tied to a hardware authenticator.

Question 3

A user's access to a classified database is determined solely by their job role and does not account for individual permissions. This is an example of which access control model?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

RBAC grants access based on predefined roles assigned to users rather than individual identity attributes.

Question 4

When an organization implements privileged access workstations (PAWs), what primary risk is being mitigated?

Accepted Answer

Credential theft through malware on general-use endpoints

Answer

PAWs isolate privileged credentials from internet-exposed workstations, reducing the risk of credential harvesting by malware.

Question 5

Which federation protocol uses JSON Web Tokens (JWTs) to convey identity claims between an authorization server and a resource server?

Accepted Answer

OAuth 2.0 with OpenID Connect

Answer

OpenID Connect layered on OAuth 2.0 uses JWTs (ID tokens) to communicate authenticated user identity claims.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Identity & Access Management 2