CCP IAM & Multi-Factor Authentication 2

Question 1

Which MFA method is considered MOST resistant to real-time phishing attacks?

Accepted Answer

FIDO2/WebAuthn hardware key

Answer

FIDO2/WebAuthn binds authentication to the specific origin domain, making real-time phishing ineffective because stolen credentials cannot be replayed on a different site.

Question 2

What is the primary security risk of using SMS as an MFA factor?

Accepted Answer

SIM swapping attacks can redirect messages to an attacker

Answer

SIM swapping allows attackers to convince carriers to transfer a victim's phone number to an attacker-controlled SIM, intercepting all SMS messages including OTPs.

Question 3

In a federated identity model, what role does the Identity Provider (IdP) play?

Accepted Answer

It authenticates users and issues tokens that Service Providers trust

Answer

The IdP authenticates users and issues assertions or tokens (e.g., SAML assertions, JWTs) that Service Providers accept as proof of authentication.

Question 4

Which access control model assigns permissions based on user attributes and environmental conditions rather than predefined roles?

Accepted Answer

Attribute-Based Access Control (ABAC)

Answer

ABAC evaluates policies against attributes of the user, resource, and environment (e.g., time, location) to make dynamic access decisions.

Question 5

What does 'just-in-time (JIT) provisioning' mean in the context of IAM?

Accepted Answer

User accounts are created automatically at the moment of first login via federation

Answer

JIT provisioning automatically creates a user account in the Service Provider the first time a user successfully authenticates through a federated identity system.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP IAM & Multi-Factor Authentication 2