CASP+ Identity and Access Management 3

Question 1

When implementing emergency 'break-glass' accounts, what is the recommended security approach?

Accepted Answer

Store credentials in secured physical or digital storage with all access events logged and reviewed

Answer

Disable them permanently and rely on vendor emergency support when needed

Answer

Share credentials among all senior administrators to ensure availability

Answer

Use regular user accounts with temporarily elevated privileges granted on demand

Question 2

What is the purpose of step-up authentication in a risk-adaptive IAM system?

Accepted Answer

To require stronger authentication when accessing higher-risk resources or performing sensitive operations

Answer

To automatically increase password complexity requirements over time

Answer

To escalate authentication failures to the security operations center

Answer

To upgrade legacy authentication protocols to modern standards

Question 3

Which NIST publication defines Identity Assurance Levels (IAL), Authentication Assurance Levels (AAL), and Federation Assurance Levels (FAL)?

Accepted Answer

NIST SP 800-63

Answer

NIST SP 800-53

Answer

NIST SP 800-171

Answer

NIST SP 800-137

Question 4

In cloud environments, what is the primary security consequence of misconfigured IAM policies?

Accepted Answer

Overly permissive access leading to unauthorized resource access or large-scale data breaches

Answer

Increased storage costs due to excessive logging of IAM events

Answer

Slower authentication response times affecting user productivity

Answer

Incompatibility with on-premises directory synchronization

Question 5

In an Identity Governance and Administration (IGA) solution, how does identity governance differ from access management?

Accepted Answer

Identity governance focuses on policy compliance and access certification; access management handles real-time enforcement

Answer

Identity governance handles authentication; access management handles data encryption

Answer

Identity governance is for external users; access management is for internal employees

Answer

Identity governance uses hardware tokens; access management uses software tokens

Question 6

Which technique most effectively prevents token replay attacks in an OAuth 2.0 implementation?

Accepted Answer

Implementing short-lived access tokens combined with refresh token rotation that invalidates used tokens

Answer

Using longer token expiration times to reduce re-authentication friction

Answer

Storing access tokens in browser local storage for persistence

Answer

Requiring full re-authentication every hour regardless of token validity

Question 7

What is the primary security advantage of FIDO2/WebAuthn over traditional password-based or SMS-based MFA?

Accepted Answer

It provides phishing-resistant authentication by cryptographically binding credentials to the specific website origin

Answer

It is significantly cheaper to implement than other authentication systems

Answer

It requires less end-user training and support than traditional MFA methods

Answer

It functions entirely without any hardware or software components on the user device