CAP Identity & Access Management 3 — Questions and Answers
Question 1: A cloud service provider maintains shared infrastructure used by multiple federal agencies. Which NIST document specifically guides security for such multi-tenant environments under the federal authorization process?
- NIST SP 800-37
- NIST SP 800-145
- FedRAMP Authorization Framework (Correct answer)
- NIST SP 800-171
Correct answer: FedRAMP Authorization Framework
FedRAMP provides a standardized approach to security assessment and authorization for cloud services used by federal agencies.
Question 2: Which type of authentication token generates a one-time password synchronized to a time-based algorithm, satisfying the AAL2 requirement under NIST SP 800-63B?
- SMS-based OTP
- TOTP hardware token (Correct answer)
- Knowledge-based authentication (KBA)
- Email magic link
Correct answer: TOTP hardware token
TOTP hardware tokens are phishing-resistant single-factor cryptographic devices that meet NIST 800-63B AAL2 requirements.
Question 3: When reviewing an access control list, a CAP professional notices a terminated employee still has active credentials. Which principle was violated?
- Separation of duties
- Need to know
- Timely account deprovisioning (least privilege lifecycle) (Correct answer)
- Dual control
Correct answer: Timely account deprovisioning (least privilege lifecycle)
Failing to disable accounts promptly after employment termination violates the account lifecycle management aspect of least privilege.
Question 4: In a zero-trust architecture, what replaces network location as the primary basis for access decisions?
- IP address whitelisting
- Continuous verification of identity, device health, and context (Correct answer)
- VPN connection status
- Physical badge access
Correct answer: Continuous verification of identity, device health, and context
Zero trust requires continuous validation of user identity, device posture, and contextual signals before granting access, regardless of network location.
Question 5: An organization uses attribute-based access control where a policy states 'grant access if user.clearance >= data.classification AND user.project == data.project.' This policy is evaluated by which component?
- Policy Enforcement Point (PEP)
- Policy Decision Point (PDP) (Correct answer)
- Policy Administration Point (PAP)
- Policy Information Point (PIP)
Correct answer: Policy Decision Point (PDP)
The PDP evaluates access requests against policies and returns permit or deny decisions to the PEP.
Question 6: Which NIST SP 800-53 control requires organizations to review accounts at defined frequencies to confirm access remains appropriate?
- AC-2(3) – Disable Inactive Accounts
- AC-2(4) – Automated Audit Actions
- AC-2(j) – Account Review (Correct answer)
- IA-4 – Identifier Management
Correct answer: AC-2(j) – Account Review
AC-2(j) requires periodic review of information system accounts to verify continued need and appropriate access levels.
Question 7: A system requires that no single administrator can both create user accounts AND assign elevated privileges. This enforces which security principle?
- Least privilege
- Need to know
- Separation of duties (Correct answer)
- Defense in depth
Correct answer: Separation of duties
Separation of duties splits sensitive tasks between multiple individuals to prevent any one person from having unchecked control.
CAP Identity & Access Management 3
A cloud service provider maintains shared infrastructure used by multiple federal agencies.
Which NIST document specifically guides security for such multi-tenant environments under the federal authorization process?