CIAM Authentication Methods 3 — Questions and Answers
Question 1: Which risk-based authentication signal is most commonly used to detect an anomalous login attempt that warrants step-up verification?
- The user's job title from HR system
- IP geolocation and device fingerprint changes (Correct answer)
- The user's password length
- The time since the user last changed their password
Correct answer: IP geolocation and device fingerprint changes
Risk-based authentication engines primarily evaluate contextual signals like IP geolocation changes, unfamiliar devices, and unusual access patterns to flag suspicious logins.
Question 2: In the context of IAM, what is the key security benefit of using hardware security keys (e.g., YubiKey) over SMS-based OTP?
- Hardware keys are cheaper to deploy
- Hardware keys are immune to SIM-swapping and phishing attacks (Correct answer)
- Hardware keys do not require enrollment
- Hardware keys work without an internet connection only
Correct answer: Hardware keys are immune to SIM-swapping and phishing attacks
Hardware security keys are phishing-resistant because they use origin-bound cryptographic challenges, and they cannot be compromised by SIM-swapping attacks that target SMS OTP.
Question 3: Which OAuth 2.0 grant type is recommended for machine-to-machine (M2M) authentication where no user is involved?
- Authorization Code
- Implicit
- Client Credentials (Correct answer)
- Device Authorization
Correct answer: Client Credentials
The Client Credentials grant type is designed for server-to-server authentication where the client acts on its own behalf using its own client ID and secret, with no user context.
Question 4: A user presents a smartcard to authenticate to a workstation. The workstation validates the certificate chain against a CRL. What does CRL stand for?
- Certificate Rotation Log
- Certificate Revocation List (Correct answer)
- Cryptographic Registration Ledger
- Certificate Renewal Link
Correct answer: Certificate Revocation List
A Certificate Revocation List (CRL) is a published list of digital certificates that have been revoked by the issuing CA before their expiration date.
Question 5: What is the purpose of the 'nonce' parameter in OpenID Connect authentication requests?
- To encrypt the ID token payload
- To prevent replay attacks by binding the token to the specific request (Correct answer)
- To specify the desired scopes for the token
- To indicate the preferred authentication method
Correct answer: To prevent replay attacks by binding the token to the specific request
The nonce is a random value included in the authentication request and embedded in the ID token, allowing the client to verify the token was issued in response to that specific request.
Question 6: Which authentication method is considered most vulnerable to credential stuffing attacks?
- Certificate-based authentication
- Single-factor username/password authentication (Correct answer)
- FIDO2 passwordless authentication
- Smart card authentication
Correct answer: Single-factor username/password authentication
Single-factor username/password authentication is highly susceptible to credential stuffing because attackers can test breached credential lists against the login endpoint at scale.
Question 7: In Kerberos authentication, what is the role of the Key Distribution Center (KDC)?
- To store all user passwords in plaintext for verification
- To issue tickets that allow users to authenticate to services without re-entering credentials (Correct answer)
- To perform biometric verification for each service request
- To maintain a real-time list of active user sessions
Correct answer: To issue tickets that allow users to authenticate to services without re-entering credentials
The KDC issues Ticket Granting Tickets (TGTs) and service tickets, enabling users to authenticate to network services without transmitting passwords across the network.
CIAM Authentication Methods 3
Which risk-based authentication signal is most commonly used to detect an anomalous login attempt that warrants step-up verification?