CAP Identity & Access Management 3

Question 1

A cloud service provider maintains shared infrastructure used by multiple federal agencies. Which NIST document specifically guides security for such multi-tenant environments under the federal authorization process?

Accepted Answer

FedRAMP Authorization Framework

Answer

FedRAMP provides a standardized approach to security assessment and authorization for cloud services used by federal agencies.

Question 2

Which type of authentication token generates a one-time password synchronized to a time-based algorithm, satisfying the AAL2 requirement under NIST SP 800-63B?

Accepted Answer

TOTP hardware token

Answer

TOTP hardware tokens are phishing-resistant single-factor cryptographic devices that meet NIST 800-63B AAL2 requirements.

Question 3

When reviewing an access control list, a CAP professional notices a terminated employee still has active credentials. Which principle was violated?

Accepted Answer

Timely account deprovisioning (least privilege lifecycle)

Answer

Failing to disable accounts promptly after employment termination violates the account lifecycle management aspect of least privilege.

Question 4

In a zero-trust architecture, what replaces network location as the primary basis for access decisions?

Accepted Answer

Continuous verification of identity, device health, and context

Answer

Zero trust requires continuous validation of user identity, device posture, and contextual signals before granting access, regardless of network location.

Question 5

An organization uses attribute-based access control where a policy states 'grant access if user.clearance >= data.classification AND user.project == data.project.' This policy is evaluated by which component?

Accepted Answer

Policy Decision Point (PDP)

Answer

The PDP evaluates access requests against policies and returns permit or deny decisions to the PEP.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Identity & Access Management 3