CCP CCP Identity & Access Management 2 — Questions and Answers
Question 1: What is the purpose of a Privileged Access Workstation (PAW) in an enterprise IAM strategy?
- To provide internet access for administrators
- To isolate administrative tasks on a hardened, dedicated device (Correct answer)
- To share credentials among IT staff securely
- To automate user provisioning workflows
Correct answer: To isolate administrative tasks on a hardened, dedicated device
A PAW is a dedicated, hardened workstation used exclusively for privileged administrative tasks to prevent credential theft and lateral movement.
Question 2: Which protocol allows network devices to centralize authentication, authorization, and accounting for remote access users?
- SAML
- OAuth 2.0
- RADIUS (Correct answer)
- OpenID Connect
Correct answer: RADIUS
RADIUS (Remote Authentication Dial-In User Service) centralizes AAA functions for network access, widely used for VPN and Wi-Fi authentication.
Question 3: What distinguishes OAuth 2.0 from OpenID Connect (OIDC)?
- OAuth 2.0 is for authentication; OIDC is for authorization
- OAuth 2.0 is for authorization; OIDC adds an identity layer on top for authentication (Correct answer)
- They are identical standards with different names
- OAuth 2.0 uses XML; OIDC uses JSON
Correct answer: OAuth 2.0 is for authorization; OIDC adds an identity layer on top for authentication
OAuth 2.0 handles delegated authorization (granting access to resources), while OIDC extends it with an ID token to provide authentication and user identity information.
Question 4: Which concept in IAM separates duties so that no single user can complete a sensitive transaction alone, reducing fraud risk?
- Least privilege
- Need-to-know
- Separation of duties (SoD) (Correct answer)
- Account lockout
Correct answer: Separation of duties (SoD)
Separation of duties divides critical tasks among multiple individuals so that collusion is required to commit fraud or errors, serving as an internal control.
Question 5: A security team wants to ensure that privileged sessions are recorded and can be played back for audit purposes. Which tool category addresses this requirement?
- Identity governance platform
- Privileged Access Management (PAM) solution (Correct answer)
- Security Information and Event Management (SIEM)
- Directory service
Correct answer: Privileged Access Management (PAM) solution
PAM solutions provide session recording, keystroke logging, and playback capabilities for privileged accounts, supporting forensic investigation and compliance audits.
Question 6: What is the primary function of an Identity Provider (IdP) in a federated identity architecture?
- To store application data for end users
- To authenticate users and issue identity assertions to service providers (Correct answer)
- To manage firewall rules for cloud applications
- To encrypt data in transit between services
Correct answer: To authenticate users and issue identity assertions to service providers
An IdP authenticates users and issues tokens or assertions that service providers trust, enabling SSO across multiple applications without separate credential stores.
CCP CCP Identity & Access Management 2
What is the purpose of a Privileged Access Workstation (PAW) in an enterprise IAM strategy?