CCP IAM & Multi-Factor Authentication 3 — Questions and Answers
Question 1: What is the purpose of an IAM access review (also called a recertification campaign)?
- To reset all user passwords on a schedule
- To periodically verify that user access rights remain appropriate and remove unnecessary privileges (Correct answer)
- To audit firewall rules for compliance
- To update MFA device registrations
Correct answer: To periodically verify that user access rights remain appropriate and remove unnecessary privileges
Access reviews ensure accumulated privileges are recertified by managers or owners, supporting least privilege by removing access that is no longer needed.
Question 2: Which attack exploits the trust relationship between a user's browser and a web application to perform unauthorized actions using the user's authenticated session?
- SQL Injection
- Cross-Site Request Forgery (CSRF) (Correct answer)
- Man-in-the-Middle
- Session fixation
Correct answer: Cross-Site Request Forgery (CSRF)
CSRF tricks an authenticated user's browser into sending forged requests to a trusted site, leveraging the existing session cookie to perform unauthorized actions.
Question 3: In OAuth 2.0, what does the 'scope' parameter control?
- The geographic region where tokens are valid
- The specific permissions and resources the access token grants (Correct answer)
- The token expiration window
- The encryption algorithm used for the token
Correct answer: The specific permissions and resources the access token grants
Scopes define the level of access requested by the client, limiting what actions the access token permits on the resource server.
Question 4: What is 'privilege creep' in IAM?
- An attacker slowly escalating privileges over time
- The gradual accumulation of excessive access rights as users change roles without deprovisioning old access (Correct answer)
- A feature where privileges expand automatically based on usage
- Temporary privilege elevation that was never revoked
Correct answer: The gradual accumulation of excessive access rights as users change roles without deprovisioning old access
Privilege creep occurs when users accumulate access rights from previous roles without proper deprovisioning, violating the principle of least privilege.
Question 5: Which MFA enrollment best practice prevents account takeover during the self-service MFA registration process?
- Requiring users to register MFA before first login using a temporary code sent to a verified channel (Correct answer)
- Allowing MFA to be added through any public web form
- Permitting MFA enrollment without identity verification
- Storing backup codes in the user's profile page
Correct answer: Requiring users to register MFA before first login using a temporary code sent to a verified channel
Requiring identity verification (e.g., a code sent to a pre-verified email or phone) before MFA enrollment ensures an attacker cannot register their own MFA device for a victim account.
Question 6: What is the key difference between authentication and authorization?
- Authentication grants resource access; authorization verifies identity
- Authentication verifies who you are; authorization determines what you are allowed to do (Correct answer)
- They are interchangeable terms in IAM
- Authorization happens before authentication in modern systems
Correct answer: Authentication verifies who you are; authorization determines what you are allowed to do
Authentication confirms identity (who you are), while authorization determines permissions (what you can access or do) after identity is established.
Question 7: A company wants to ensure contractors can only access systems during business hours. Which IAM feature addresses this requirement?
- Role-Based Access Control
- Time-based access restrictions in ABAC policies (Correct answer)
- Password complexity requirements
- Single Sign-On federation
Correct answer: Time-based access restrictions in ABAC policies
ABAC policies can include environmental conditions like time of day, allowing access to be automatically denied outside defined hours.
CCP IAM & Multi-Factor Authentication 3
What is the purpose of an IAM access review (also called a recertification campaign)?