CIAM Authorization Frameworks 3 — Questions and Answers
Question 1: In an ABAC system, which of the following is an example of an 'environmental attribute' used in an access control decision?
- User's department
- Resource classification level
- Time of day or geographic location (Correct answer)
- Action type (read/write)
Correct answer: Time of day or geographic location
Environmental attributes capture contextual conditions such as time of day, network location, or device security posture at the moment of the access request.
Question 2: Which OAuth 2.0 token type is a short-lived credential used to access protected resources on behalf of a user?
- Refresh token
- ID token
- Access token (Correct answer)
- Authorization code
Correct answer: Access token
An access token is a short-lived credential presented by the client to the resource server to access protected resources on behalf of the resource owner.
Question 3: Which policy combining algorithm in XACML returns 'Deny' if any applicable policy returns 'Deny'?
- Permit-overrides
- Deny-overrides (Correct answer)
- First-applicable
- Only-one-applicable
Correct answer: Deny-overrides
The Deny-overrides combining algorithm returns Deny if any applicable policy or rule evaluates to Deny, prioritizing denial over permit decisions.
Question 4: What is the purpose of token introspection (RFC 7662) in OAuth 2.0?
- To refresh expired access tokens
- To allow a resource server to validate and query metadata about a token (Correct answer)
- To revoke access tokens at the authorization server
- To exchange one token type for another
Correct answer: To allow a resource server to validate and query metadata about a token
Token introspection allows a resource server to query the authorization server to determine whether a token is active and retrieve its metadata such as scope and expiration.
Question 5: In the context of federated identity and authorization, what does a 'relying party' depend on?
- Local directory services for authorization decisions
- An identity provider's assertions about the user (Correct answer)
- The resource owner's explicit approval for each request
- Hardware security modules for token validation
Correct answer: An identity provider's assertions about the user
A relying party (RP) trusts and depends on assertions or claims from an identity provider (IdP) to make authentication and authorization decisions rather than managing identity itself.
Question 6: Which approach best describes 'least privilege' as applied to OAuth 2.0 scopes?
- Requesting all available scopes upfront to avoid multiple authorization prompts
- Requesting only the minimum scopes necessary for the current operation (Correct answer)
- Using admin scopes to simplify scope management
- Caching broad scopes to improve application performance
Correct answer: Requesting only the minimum scopes necessary for the current operation
Least privilege in OAuth 2.0 means requesting only the scopes required for the specific task at hand, minimizing the potential damage if the access token is compromised.
Question 7: What distinguishes 'coarse-grained' authorization from 'fine-grained' authorization?
- Coarse-grained uses cryptographic tokens while fine-grained uses session cookies
- Coarse-grained controls access at a broad level (e.g., API access) while fine-grained controls specific data or operations (Correct answer)
- Fine-grained authorization is only applicable to RBAC systems
- Coarse-grained authorization is evaluated at the resource server; fine-grained at the client
Correct answer: Coarse-grained controls access at a broad level (e.g., API access) while fine-grained controls specific data or operations
Coarse-grained authorization makes broad allow/deny decisions (e.g., can access the HR API), while fine-grained authorization makes detailed decisions (e.g., can view salary data only for direct reports).
CIAM Authorization Frameworks 3
In an ABAC system, which of the following is an example of an 'environmental attribute' used in an access control decision?