CIAM Authentication Methods 3

Question 1

Which risk-based authentication signal is most commonly used to detect an anomalous login attempt that warrants step-up verification?

Accepted Answer

IP geolocation and device fingerprint changes

Answer

Risk-based authentication engines primarily evaluate contextual signals like IP geolocation changes, unfamiliar devices, and unusual access patterns to flag suspicious logins.

Question 2

In the context of IAM, what is the key security benefit of using hardware security keys (e.g., YubiKey) over SMS-based OTP?

Accepted Answer

Hardware keys are immune to SIM-swapping and phishing attacks

Answer

Hardware security keys are phishing-resistant because they use origin-bound cryptographic challenges, and they cannot be compromised by SIM-swapping attacks that target SMS OTP.

Question 3

Which OAuth 2.0 grant type is recommended for machine-to-machine (M2M) authentication where no user is involved?

Accepted Answer

Client Credentials

Answer

The Client Credentials grant type is designed for server-to-server authentication where the client acts on its own behalf using its own client ID and secret, with no user context.

Question 4

A user presents a smartcard to authenticate to a workstation. The workstation validates the certificate chain against a CRL. What does CRL stand for?

Accepted Answer

Certificate Revocation List

Answer

A Certificate Revocation List (CRL) is a published list of digital certificates that have been revoked by the issuing CA before their expiration date.

Question 5

What is the purpose of the 'nonce' parameter in OpenID Connect authentication requests?

Accepted Answer

To prevent replay attacks by binding the token to the specific request

Answer

The nonce is a random value included in the authentication request and embedded in the ID token, allowing the client to verify the token was issued in response to that specific request.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Authentication Methods 3