CCD Identity & Access Management 2 — Questions and Answers
Question 1: What is federated identity management?
- A system where each application manages its own user database independently
- A framework allowing users to use the same identity across multiple organizations or domains (Correct answer)
- A method of assigning unique identities to network devices only
- A process for revoking user access across all systems simultaneously
Correct answer: A framework allowing users to use the same identity across multiple organizations or domains
Federated identity enables organizations to share identity information across trust boundaries so users can authenticate once and access resources in multiple domains.
Question 2: What is the key difference between authentication and authorization?
- Authentication verifies what a user can do; authorization verifies who a user is
- Authentication verifies who a user is; authorization determines what the user is permitted to do (Correct answer)
- Both authentication and authorization refer to the same security process
- Authorization always occurs before authentication in the access control process
Correct answer: Authentication verifies who a user is; authorization determines what the user is permitted to do
Authentication confirms identity (who you are), while authorization determines what actions or resources that verified identity is permitted to access.
Question 3: What is Just-In-Time (JIT) access provisioning?
- Granting permanent administrative access to all senior staff
- Providing temporary, time-limited elevated privileges only when needed for a specific task (Correct answer)
- Automatically removing all access rights outside of business hours
- Assigning access rights based on a user's real-time geographic location
Correct answer: Providing temporary, time-limited elevated privileges only when needed for a specific task
JIT access provides temporary elevated privileges for specific tasks only when needed, minimizing the exposure window for privileged accounts.
Question 4: Which protocol is commonly used for federated enterprise authentication using XML-based assertions?
- OAuth 2.0
- OpenID Connect
- SAML (Security Assertion Markup Language) (Correct answer)
- RADIUS
Correct answer: SAML (Security Assertion Markup Language)
SAML is an XML-based standard used for exchanging authentication and authorization data between identity providers and service providers.
Question 5: What is credential stuffing?
- Hiding credentials within encrypted configuration files
- Using lists of breached username and password pairs to attempt unauthorized access to other services (Correct answer)
- Brute-forcing passwords by trying every possible character combination
- Physically stealing authentication tokens or smart cards from users
Correct answer: Using lists of breached username and password pairs to attempt unauthorized access to other services
Credential stuffing exploits password reuse by taking leaked credentials from one breach and testing them against other services.
Question 6: In an IAM context, what is an Identity Provider (IdP)?
- A service that creates, manages, and validates user credentials and issues identity assertions (Correct answer)
- A hardware device that generates one-time passwords for MFA
- A network appliance that monitors and logs user authentication activity
- A database storing organizational assets and their respective owners
Correct answer: A service that creates, manages, and validates user credentials and issues identity assertions
An IdP is a system that creates, maintains, and manages identity information and provides authentication services to relying party applications.
Question 7: What is account enumeration and why is it a security concern?
- The auditing of privileged accounts for compliance; it is a beneficial process
- A technique attackers use to discover valid usernames by analyzing application error messages (Correct answer)
- A method to count all active user sessions on a network system
- The sequential creation of account IDs during user provisioning
Correct answer: A technique attackers use to discover valid usernames by analyzing application error messages
Account enumeration allows attackers to confirm valid usernames through differential error responses, which can then be targeted in password attacks.
CCD Identity & Access Management 2
What is federated identity management?