CAP Identity & Access Management 4

Question 1

Under FIPS 201, PIV credentials issued to federal employees must support which minimum number of authentication factors when accessing high-value assets?

Accepted Answer

Two factors (card + PIN)

Answer

FIPS 201 PIV requires at minimum two-factor authentication combining physical card possession with a PIN for logical access.

Question 2

A CAP professional is assessing a system where user A can grant other users permissions that exceed user A's own permissions. Which access control weakness does this represent?

Accepted Answer

Privilege escalation via DAC misconfiguration

Answer

In DAC environments, improper implementation can allow owners to delegate permissions they do not actually possess, enabling privilege escalation.

Question 3

Which NIST SP 800-53 control enhancement specifically requires cryptographic replay-resistant authentication mechanisms?

Accepted Answer

IA-2(8)

Answer

IA-2(8) requires network access for privileged accounts to use replay-resistant authentication mechanisms such as PKI or OTP.

Question 4

An organization implements Just-in-Time (JIT) privileged access, where elevated rights are granted only for the duration of an approved task. This practice primarily supports which security principle?

Accepted Answer

Least privilege

Answer

JIT access directly implements least privilege by ensuring elevated rights exist only as long as operationally necessary.

Question 5

When a federal system uses SAML 2.0 for single sign-on, the component that makes assertions about user identity to the service provider is called what?

Accepted Answer

Identity Provider (IdP)

Answer

The Identity Provider authenticates the user and issues SAML assertions containing identity and attribute claims to the Service Provider.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Identity & Access Management 4