CCISO Identity & Access Management 2 — Questions and Answers
Question 1: Multi-Factor Authentication (MFA) requires users to present verification from at least how many distinct authentication factor categories?
- One factor from any category
- Two or more factors from different categories (Correct answer)
- Three factors from the same category
- Four factors for privileged accounts only
Correct answer: Two or more factors from different categories
MFA requires at least two distinct factor categories (e.g., something you know plus something you have), making authentication significantly more resistant to credential theft.
Question 2: Which access control model makes access decisions based on data classification labels and user security clearances assigned by a central authority?
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
MAC uses centrally controlled sensitivity labels on objects and clearance levels on subjects, with access determined by policy rather than owner discretion—commonly used in government environments.
Question 3: Identity federation in the context of IAM refers to:
- Centralizing all user accounts in a single directory
- Linking a user's identity across multiple distinct identity management systems to enable cross-domain access (Correct answer)
- Requiring all users to re-authenticate every 30 minutes
- Federating firewall rules across network segments
Correct answer: Linking a user's identity across multiple distinct identity management systems to enable cross-domain access
Identity federation allows users authenticated in one domain to access resources in a separate trusting domain without needing separate credentials, enabling seamless cross-organizational access.
Question 4: Which open standard protocol is most commonly used to enable federated identity and authorization across different organizations and web applications?
- LDAP (Lightweight Directory Access Protocol)
- RADIUS (Remote Authentication Dial-In User Service)
- SAML (Security Assertion Markup Language) (Correct answer)
- NTLM (NT LAN Manager)
Correct answer: SAML (Security Assertion Markup Language)
SAML is an XML-based open standard widely used for exchanging authentication and authorization data between an identity provider and a service provider in federated SSO scenarios.
Question 5: What is the role of an Identity Provider (IdP) in a federated identity architecture?
- It stores encrypted copies of all user files
- It authenticates users and provides identity assertions to service providers (Correct answer)
- It monitors network traffic for identity-based attacks
- It manages firewall rules for identity-based access
Correct answer: It authenticates users and provides identity assertions to service providers
An IdP authenticates users and issues identity assertions or tokens (such as SAML assertions or OAuth tokens) that service providers trust to grant access without requiring separate authentication.
Question 6: The principle of separation of duties (SoD) in IAM is primarily designed to prevent:
- Unauthorized physical access to data centers
- Fraud and errors by requiring more than one person to complete a sensitive task or transaction (Correct answer)
- Weak password usage by employees
- Network-level eavesdropping on authentication traffic
Correct answer: Fraud and errors by requiring more than one person to complete a sensitive task or transaction
Separation of duties ensures no single individual has enough access to complete a sensitive action alone, requiring collusion between multiple parties to commit fraud or cause significant errors.
Question 7: Why are service accounts considered a significant identity and access management security risk in enterprise environments?
- They are temporary accounts that expire after 24 hours
- They often have excessive privileges, shared credentials, and infrequent password rotation (Correct answer)
- They are exclusively used by external vendors
- They bypass multi-factor authentication by design
Correct answer: They often have excessive privileges, shared credentials, and infrequent password rotation
Service accounts frequently accumulate over-provisioned rights, use static passwords rarely rotated, and lack individual accountability, making them attractive targets for attackers seeking persistent elevated access.
CCISO Identity & Access Management 2
Multi-Factor Authentication (MFA) requires users to present verification from at least how many distinct authentication factor categories?