CASP+ Identity and Access Management 2 — Questions and Answers
Question 1: What is the primary security benefit of implementing Just-In-Time (JIT) privileged access?
- It provides permanent elevated access for administrative efficiency
- It reduces the attack window by granting elevated privileges only when needed for a defined period (Correct answer)
- It eliminates the need for multi-factor authentication on privileged accounts
- It allows users to self-assign privileges without administrator approval
Correct answer: It reduces the attack window by granting elevated privileges only when needed for a defined period
JIT access minimizes the time elevated privileges are active, significantly reducing the window of opportunity for credential theft and misuse.
Question 2: In OAuth 2.0, what is the security advantage of the authorization code flow over the implicit flow?
- It allows client applications to directly access user credentials for efficiency
- It exchanges a short-lived code for tokens via the back channel, keeping tokens out of the browser (Correct answer)
- It provides persistent authentication without requiring token refresh
- It encrypts all user data stored at the authorization server
Correct answer: It exchanges a short-lived code for tokens via the back channel, keeping tokens out of the browser
The authorization code flow exchanges a temporary code for tokens over a secure back channel, preventing tokens from being exposed in browser history or redirects.
Question 3: What distinguishes Attribute-Based Access Control (ABAC) from Role-Based Access Control (RBAC)?
- ABAC only works for cloud environments while RBAC works on-premises
- ABAC evaluates multiple attributes (user, resource, environment) for finer-grained decisions vs. RBAC's static role assignments (Correct answer)
- ABAC requires hardware tokens while RBAC uses passwords
- ABAC is simpler to implement and manage than RBAC
Correct answer: ABAC evaluates multiple attributes (user, resource, environment) for finer-grained decisions vs. RBAC's static role assignments
ABAC evaluates combinations of user attributes, resource sensitivity, and environmental conditions, enabling context-aware access decisions beyond what static roles can express.
Question 4: Which solution provides centralized management, session monitoring, and credential vaulting for privileged accounts?
- Identity Governance and Administration (IGA)
- Privileged Access Management (PAM) (Correct answer)
- Identity Provider (IdP)
- Access Control List Manager (ACLM)
Correct answer: Privileged Access Management (PAM)
PAM solutions provide credential vaulting, session recording, just-in-time access, and centralized oversight specifically for privileged accounts and administrative access.
Question 5: What is the primary risk mitigated by implementing rigorous account lifecycle management?
- Network bandwidth overuse by active users
- Orphaned accounts retaining access after employees leave or change roles (Correct answer)
- Password complexity requirements becoming too restrictive
- Excessive storage consumption from authentication logs
Correct answer: Orphaned accounts retaining access after employees leave or change roles
Without account lifecycle management, former employees or role-changers retain access through orphaned accounts, creating unauthorized access risks that may go undetected for extended periods.
Question 6: In federated identity, what is the role of an Identity Provider (IdP)?
- To store and manage user data within the Service Provider's own database
- To authenticate users and issue identity assertions that Service Providers trust to grant access (Correct answer)
- To encrypt communications between end users and cloud applications
- To manage network-level access control lists for perimeter security
Correct answer: To authenticate users and issue identity assertions that Service Providers trust to grant access
The IdP is the authoritative source that authenticates users and issues signed assertions or tokens that relying Service Providers accept to grant access without re-authenticating.
Question 7: What is credential stuffing, and which IAM control most effectively mitigates it?
- Brute-force guessing of passwords; strong password length requirements
- Using stolen username/password pairs from data breaches to log into other services; multi-factor authentication (Correct answer)
- Social engineering to obtain credentials; security awareness training
- Malware-based credential harvesting from endpoints; EDR solutions
Correct answer: Using stolen username/password pairs from data breaches to log into other services; multi-factor authentication
Credential stuffing uses breached credentials from other sites to exploit password reuse; MFA stops the attack even when valid credentials are submitted by the attacker.
CASP+ Identity and Access Management 2
What is the primary security benefit of implementing Just-In-Time (JIT) privileged access?