CIAM Authorization Frameworks 2

Question 1

Which OAuth 2.0 grant type is specifically designed for machine-to-machine (M2M) communication where no user is involved?

Accepted Answer

Client Credentials

Answer

The Client Credentials grant type allows a client to authenticate with the authorization server using its own credentials and obtain an access token without user involvement.

Question 2

In XACML, which component is responsible for making the actual access control decision?

Accepted Answer

Policy Decision Point (PDP)

Answer

The Policy Decision Point (PDP) evaluates access requests against policies and returns an authorization decision (Permit, Deny, Indeterminate, or NotApplicable).

Question 3

What is the primary security risk of using implicit OAuth 2.0 flow in a Single Page Application (SPA)?

Accepted Answer

Access tokens are exposed in the URL fragment and browser history

Answer

In the implicit flow, access tokens are returned directly in the URL fragment, making them visible in browser history and vulnerable to interception via referrer headers.

Question 4

Which UMA 2.0 role is responsible for setting policies that govern access to protected resources?

Accepted Answer

Resource Owner

Answer

In UMA 2.0, the Resource Owner sets policies at the authorization server to control who can access their resources and under what conditions.

Question 5

In OAuth 2.0, what does the 'state' parameter protect against?

Accepted Answer

Cross-Site Request Forgery (CSRF) attacks

Answer

The 'state' parameter is an opaque value used to maintain state between the request and callback, primarily to prevent CSRF attacks against the client's redirect URI.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Authorization Frameworks 2