CASP+ Identity and Access Management 1 — Questions and Answers
Question 1: What is the primary difference between authentication and authorization in an IAM framework?
- Authentication verifies identity; authorization determines permissions (Correct answer)
- Authentication grants access; authorization verifies credentials
- Authentication is for humans; authorization is for systems
- Authentication uses passwords; authorization uses tokens
Correct answer: Authentication verifies identity; authorization determines permissions
Authentication confirms who a user is, while authorization determines what resources and actions the authenticated user is permitted to access.
Question 2: Which protocol is primarily used for federated identity management and single sign-on across different organizations?
- LDAP
- SAML (Correct answer)
- RADIUS
- Kerberos
Correct answer: SAML
SAML (Security Assertion Markup Language) is the primary protocol for federated identity, enabling SSO across organizational boundaries via XML-based assertions.
Question 3: What is the primary purpose of SCIM (System for Cross-domain Identity Management)?
- To encrypt identity tokens during transmission
- To automate user provisioning and deprovisioning across systems (Correct answer)
- To provide multi-factor authentication services
- To manage certificate lifecycles in PKI
Correct answer: To automate user provisioning and deprovisioning across systems
SCIM automates the exchange of user identity information between identity providers and service providers, streamlining provisioning and deprovisioning workflows.
Question 4: In a Zero Trust architecture, which set of principles governs access decisions?
- Trust but verify, least privilege, perimeter enforcement
- Verify explicitly, use least-privilege access, assume breach (Correct answer)
- Implicit trust, role-based access, network segmentation
- Perimeter defense, group policy enforcement, periodic re-authentication
Correct answer: Verify explicitly, use least-privilege access, assume breach
Zero Trust operates on verify explicitly (always authenticate and authorize), least-privilege access, and assume breach when designing security controls.
Question 5: Which access control model uses security labels and clearance levels to enforce access, commonly found in government environments?
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
MAC enforces access using system-assigned sensitivity labels and user clearance levels, making it non-discretionary and common in high-security government systems.
Question 6: What is the primary security risk of using shared accounts in an enterprise environment?
- Increased network bandwidth consumption
- Inability to perform individual accountability and non-repudiation (Correct answer)
- Higher software licensing costs
- Reduced system performance due to concurrent logins
Correct answer: Inability to perform individual accountability and non-repudiation
Shared accounts prevent attribution of actions to specific individuals, undermining non-repudiation and making forensic investigations unreliable.
Question 7: What is the security purpose of a Privileged Access Workstation (PAW)?
- To provide faster processing for privileged administrative tasks
- To isolate privileged tasks from general-purpose computing to reduce attack surface (Correct answer)
- To encrypt all administrative communications end-to-end
- To automate privileged account creation and rotation
Correct answer: To isolate privileged tasks from general-purpose computing to reduce attack surface
PAWs are hardened workstations dedicated exclusively to privileged tasks, preventing exposure of privileged credentials on systems used for risky activities like web browsing.
CASP+ Identity and Access Management 1
What is the primary difference between authentication and authorization in an IAM framework?