CCISO Identity & Access Management 2

Question 1

Multi-Factor Authentication (MFA) requires users to present verification from at least how many distinct authentication factor categories?

Accepted Answer

Two or more factors from different categories

Answer

One factor from any category

Answer

Three factors from the same category

Answer

Four factors for privileged accounts only

Question 2

Which access control model makes access decisions based on data classification labels and user security clearances assigned by a central authority?

Accepted Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 3

Identity federation in the context of IAM refers to:

Accepted Answer

Linking a user's identity across multiple distinct identity management systems to enable cross-domain access

Answer

Centralizing all user accounts in a single directory

Answer

Requiring all users to re-authenticate every 30 minutes

Answer

Federating firewall rules across network segments

Question 4

Which open standard protocol is most commonly used to enable federated identity and authorization across different organizations and web applications?

Accepted Answer

SAML (Security Assertion Markup Language)

Answer

LDAP (Lightweight Directory Access Protocol)

Answer

RADIUS (Remote Authentication Dial-In User Service)

Answer

NTLM (NT LAN Manager)

Question 5

What is the role of an Identity Provider (IdP) in a federated identity architecture?

Accepted Answer

It authenticates users and provides identity assertions to service providers

Answer

It stores encrypted copies of all user files

Answer

It monitors network traffic for identity-based attacks

Answer

It manages firewall rules for identity-based access

Question 6

The principle of separation of duties (SoD) in IAM is primarily designed to prevent:

Accepted Answer

Fraud and errors by requiring more than one person to complete a sensitive task or transaction

Answer

Unauthorized physical access to data centers

Answer

Weak password usage by employees

Answer

Network-level eavesdropping on authentication traffic

Question 7

Why are service accounts considered a significant identity and access management security risk in enterprise environments?

Accepted Answer

They often have excessive privileges, shared credentials, and infrequent password rotation

Answer

They are temporary accounts that expire after 24 hours

Answer

They are exclusively used by external vendors

Answer

They bypass multi-factor authentication by design