CAP Identity & Access Management 5

Question 1

Under the CAP exam body of knowledge, which activity ensures that access rights granted to users are aligned with current business needs and have not accumulated beyond what is required?

Accepted Answer

Access recertification (access review)

Answer

Access recertification campaigns periodically validate that user entitlements remain appropriate and remove access that is no longer needed.

Question 2

A system uses both a hardware token and a biometric scan to authenticate. If an attacker compromises the biometric template database, what compensating control most directly limits the damage?

Accepted Answer

Encrypting the biometric templates at rest

Answer

Encrypting stored biometric templates prevents attackers from extracting usable reference data even if they gain access to the database.

Question 3

Which concept allows a cloud consumer to trust a cloud provider's security controls without conducting their own full assessment, based on a shared authorization package?

Accepted Answer

Reciprocity

Answer

Reciprocity allows agencies to accept another agency's or provider's existing ATO package rather than conducting a redundant assessment.

Question 4

An identity governance solution automatically flags when a user's role assignments conflict—for example, holding both 'invoice creator' and 'invoice approver' roles. This is an example of which IAM capability?

Accepted Answer

Segregation of duties (SoD) conflict detection

Answer

SoD conflict detection identifies role combinations that violate separation of duties policies, preventing a single user from having incompatible privileges.

Question 5

Under NIST SP 800-53 control IA-5, which authenticator management requirement specifically addresses the minimum complexity and lifetime of passwords?

Accepted Answer

IA-5(1) – Password-Based Authentication

Answer

IA-5(1) defines requirements for password complexity, history, minimum/maximum lifetimes, and reuse restrictions.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Identity & Access Management 5