CCP CCP Identity & Access Management 1 — Questions and Answers
Question 1: Which IAM concept ensures that users are granted only the minimum permissions necessary to perform their job functions?
- Separation of duties
- Least privilege (Correct answer)
- Role explosion
- Federated identity
Correct answer: Least privilege
The principle of least privilege limits user access rights to only what is strictly required for their role, reducing the attack surface.
Question 2: What protocol is most commonly used to enable Single Sign-On (SSO) across web applications using token-based assertions?
- LDAP
- RADIUS
- SAML 2.0 (Correct answer)
- Kerberos
Correct answer: SAML 2.0
SAML 2.0 (Security Assertion Markup Language) is the predominant standard for SSO, exchanging XML-based authentication and authorization assertions between identity providers and service providers.
Question 3: An organization wants to verify a user's identity using something they know, something they have, and something they are. What is this called?
- Dual-factor authentication
- Multi-factor authentication (MFA) (Correct answer)
- Federated authentication
- Adaptive authentication
Correct answer: Multi-factor authentication (MFA)
Multi-factor authentication (MFA) combines two or more distinct authentication factors — knowledge, possession, and inherence — to strengthen identity verification.
Question 4: Which access control model assigns permissions based on organizational roles rather than individual user identities?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC groups users into roles and assigns permissions to those roles, simplifying administration and enforcing consistent access policies.
Question 5: What is the primary security risk associated with orphaned accounts in an enterprise directory?
- They consume excessive storage
- They provide attackers with valid credentials to exploit (Correct answer)
- They cause authentication latency
- They conflict with group policy objects
Correct answer: They provide attackers with valid credentials to exploit
Orphaned accounts belong to former employees or unused services and represent active credentials that attackers can leverage for unauthorized access.
Question 6: Which IAM framework concept involves continuously verifying identity and device posture rather than trusting users once they are inside the network perimeter?
- Perimeter-based security
- Zero Trust (Correct answer)
- Defense in depth
- Identity federation
Correct answer: Zero Trust
Zero Trust operates on the principle of 'never trust, always verify,' requiring continuous validation of identity, device health, and context for every access request.
CCP CCP Identity & Access Management 1
Which IAM concept ensures that users are granted only the minimum permissions necessary to perform their job functions?