CIAM Authorization Frameworks 2 — Questions and Answers
Question 1: Which OAuth 2.0 grant type is specifically designed for machine-to-machine (M2M) communication where no user is involved?
- Authorization Code
- Client Credentials (Correct answer)
- Resource Owner Password Credentials
- Device Authorization
Correct answer: Client Credentials
The Client Credentials grant type allows a client to authenticate with the authorization server using its own credentials and obtain an access token without user involvement.
Question 2: In XACML, which component is responsible for making the actual access control decision?
- Policy Enforcement Point (PEP)
- Policy Decision Point (PDP) (Correct answer)
- Policy Information Point (PIP)
- Policy Administration Point (PAP)
Correct answer: Policy Decision Point (PDP)
The Policy Decision Point (PDP) evaluates access requests against policies and returns an authorization decision (Permit, Deny, Indeterminate, or NotApplicable).
Question 3: What is the primary security risk of using implicit OAuth 2.0 flow in a Single Page Application (SPA)?
- Refresh tokens are not supported
- Access tokens are exposed in the URL fragment and browser history (Correct answer)
- The flow requires PKCE which SPAs cannot implement
- Client secrets are required but cannot be stored securely
Correct answer: Access tokens are exposed in the URL fragment and browser history
In the implicit flow, access tokens are returned directly in the URL fragment, making them visible in browser history and vulnerable to interception via referrer headers.
Question 4: Which UMA 2.0 role is responsible for setting policies that govern access to protected resources?
- Requesting Party
- Resource Server
- Authorization Server
- Resource Owner (Correct answer)
Correct answer: Resource Owner
In UMA 2.0, the Resource Owner sets policies at the authorization server to control who can access their resources and under what conditions.
Question 5: In OAuth 2.0, what does the 'state' parameter protect against?
- Token expiration attacks
- Cross-Site Request Forgery (CSRF) attacks (Correct answer)
- SQL injection in redirect URIs
- Brute-force client secret guessing
Correct answer: Cross-Site Request Forgery (CSRF) attacks
The 'state' parameter is an opaque value used to maintain state between the request and callback, primarily to prevent CSRF attacks against the client's redirect URI.
Question 6: Which authorization model assigns permissions based on a user's job function within an organization?
- Attribute-Based Access Control (ABAC)
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Mandatory Access Control (MAC)
Correct answer: Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) grants permissions based on roles assigned to users, where roles correspond to job functions or responsibilities within the organization.
Question 7: What is PKCE (Proof Key for Code Exchange) designed to prevent in OAuth 2.0 public clients?
- Token replay attacks
- Authorization code interception attacks (Correct answer)
- Phishing via redirect URI manipulation
- Excessive scope requests
Correct answer: Authorization code interception attacks
PKCE prevents authorization code interception attacks by binding the authorization code to a dynamically generated code verifier known only to the legitimate client.
CIAM Authorization Frameworks 2
Which OAuth 2.0 grant type is specifically designed for machine-to-machine (M2M) communication where no user is involved?