CASP+ Identity and Access Management 3

Question 1

When implementing emergency 'break-glass' accounts, what is the recommended security approach?

Accepted Answer

Store credentials in secured physical or digital storage with all access events logged and reviewed

Answer

Break-glass accounts must balance emergency accessibility with strict accountability, requiring tightly controlled credential storage and mandatory review of every access event.

Question 2

What is the purpose of step-up authentication in a risk-adaptive IAM system?

Accepted Answer

To require stronger authentication when accessing higher-risk resources or performing sensitive operations

Answer

Step-up authentication triggers additional verification factors when users attempt high-value or sensitive operations, matching authentication strength to the risk of the specific action.

Question 3

Which NIST publication defines Identity Assurance Levels (IAL), Authentication Assurance Levels (AAL), and Federation Assurance Levels (FAL)?

Accepted Answer

NIST SP 800-63

Answer

NIST SP 800-63 (Digital Identity Guidelines) establishes the assurance level framework covering identity proofing (IAL), authentication strength (AAL), and federation trust (FAL).

Question 4

In cloud environments, what is the primary security consequence of misconfigured IAM policies?

Accepted Answer

Overly permissive access leading to unauthorized resource access or large-scale data breaches

Answer

Cloud IAM misconfigurations commonly grant excessive permissions, enabling attackers or malicious insiders to access, exfiltrate, or destroy sensitive data far beyond intended scope.

Question 5

In an Identity Governance and Administration (IGA) solution, how does identity governance differ from access management?

Accepted Answer

Identity governance focuses on policy compliance and access certification; access management handles real-time enforcement

Answer

IGA governance provides oversight through policy definition, access certifications, and compliance reporting, while the access management component enforces those policies at runtime.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Identity and Access Management 3