CCP IAM & Multi-Factor Authentication 2 — Questions and Answers
Question 1: Which MFA method is considered MOST resistant to real-time phishing attacks?
- SMS one-time password
- Email-based OTP
- FIDO2/WebAuthn hardware key (Correct answer)
- Time-based OTP app
Correct answer: FIDO2/WebAuthn hardware key
FIDO2/WebAuthn binds authentication to the specific origin domain, making real-time phishing ineffective because stolen credentials cannot be replayed on a different site.
Question 2: What is the primary security risk of using SMS as an MFA factor?
- SMS codes expire too quickly
- SIM swapping attacks can redirect messages to an attacker (Correct answer)
- SMS is encrypted end-to-end
- SMS OTPs are too long to intercept
Correct answer: SIM swapping attacks can redirect messages to an attacker
SIM swapping allows attackers to convince carriers to transfer a victim's phone number to an attacker-controlled SIM, intercepting all SMS messages including OTPs.
Question 3: In a federated identity model, what role does the Identity Provider (IdP) play?
- It stores user passwords locally at each service
- It authenticates users and issues tokens that Service Providers trust (Correct answer)
- It encrypts data between the user and Service Provider
- It manages firewall rules for authenticated sessions
Correct answer: It authenticates users and issues tokens that Service Providers trust
The IdP authenticates users and issues assertions or tokens (e.g., SAML assertions, JWTs) that Service Providers accept as proof of authentication.
Question 4: Which access control model assigns permissions based on user attributes and environmental conditions rather than predefined roles?
- Role-Based Access Control (RBAC)
- Mandatory Access Control (MAC)
- Attribute-Based Access Control (ABAC) (Correct answer)
- Discretionary Access Control (DAC)
Correct answer: Attribute-Based Access Control (ABAC)
ABAC evaluates policies against attributes of the user, resource, and environment (e.g., time, location) to make dynamic access decisions.
Question 5: What does 'just-in-time (JIT) provisioning' mean in the context of IAM?
- User accounts are created months before they are needed
- User accounts are created automatically at the moment of first login via federation (Correct answer)
- Privileged access is revoked exactly at session end
- Passwords are generated and emailed just before expiration
Correct answer: User accounts are created automatically at the moment of first login via federation
JIT provisioning automatically creates a user account in the Service Provider the first time a user successfully authenticates through a federated identity system.
Question 6: A user's TOTP app generates a code that the server rejects despite correct time sync. What is the MOST likely cause?
- The TOTP secret was provisioned with an incorrect shared key (Correct answer)
- The server's HMAC algorithm is SHA-512 instead of SHA-1
- The user is using an IPv6 connection
- The session cookie has expired
Correct answer: The TOTP secret was provisioned with an incorrect shared key
If the shared secret between the TOTP app and the server does not match, generated codes will never validate regardless of correct time synchronization.
Question 7: Which protocol is specifically designed to delegate authorization (not authentication) between services?
- Kerberos
- SAML 2.0
- OAuth 2.0 (Correct answer)
- OpenID Connect
Correct answer: OAuth 2.0
OAuth 2.0 is an authorization framework that allows a resource owner to grant limited access to their resources to a third party without sharing credentials.
CCP IAM & Multi-Factor Authentication 2
Which MFA method is considered MOST resistant to real-time phishing attacks?