CASP+ Identity and Access Management 2

Question 1

What is the primary security benefit of implementing Just-In-Time (JIT) privileged access?

Accepted Answer

It reduces the attack window by granting elevated privileges only when needed for a defined period

Answer

It provides permanent elevated access for administrative efficiency

Answer

It eliminates the need for multi-factor authentication on privileged accounts

Answer

It allows users to self-assign privileges without administrator approval

Question 2

In OAuth 2.0, what is the security advantage of the authorization code flow over the implicit flow?

Accepted Answer

It exchanges a short-lived code for tokens via the back channel, keeping tokens out of the browser

Answer

It allows client applications to directly access user credentials for efficiency

Answer

It provides persistent authentication without requiring token refresh

Answer

It encrypts all user data stored at the authorization server

Question 3

What distinguishes Attribute-Based Access Control (ABAC) from Role-Based Access Control (RBAC)?

Accepted Answer

ABAC evaluates multiple attributes (user, resource, environment) for finer-grained decisions vs. RBAC's static role assignments

Answer

ABAC only works for cloud environments while RBAC works on-premises

Answer

ABAC requires hardware tokens while RBAC uses passwords

Answer

ABAC is simpler to implement and manage than RBAC

Question 4

Which solution provides centralized management, session monitoring, and credential vaulting for privileged accounts?

Accepted Answer

Privileged Access Management (PAM)

Answer

Identity Governance and Administration (IGA)

Answer

Identity Provider (IdP)

Answer

Access Control List Manager (ACLM)

Question 5

What is the primary risk mitigated by implementing rigorous account lifecycle management?

Accepted Answer

Orphaned accounts retaining access after employees leave or change roles

Answer

Network bandwidth overuse by active users

Answer

Password complexity requirements becoming too restrictive

Answer

Excessive storage consumption from authentication logs

Question 6

In federated identity, what is the role of an Identity Provider (IdP)?

Accepted Answer

To authenticate users and issue identity assertions that Service Providers trust to grant access

Answer

To store and manage user data within the Service Provider's own database

Answer

To encrypt communications between end users and cloud applications

Answer

To manage network-level access control lists for perimeter security

Question 7

What is credential stuffing, and which IAM control most effectively mitigates it?

Accepted Answer

Using stolen username/password pairs from data breaches to log into other services; multi-factor authentication

Answer

Brute-force guessing of passwords; strong password length requirements

Answer

Social engineering to obtain credentials; security awareness training

Answer

Malware-based credential harvesting from endpoints; EDR solutions