CIAM Authorization Frameworks 3

Question 1

In an ABAC system, which of the following is an example of an 'environmental attribute' used in an access control decision?

Accepted Answer

Time of day or geographic location

Answer

Environmental attributes capture contextual conditions such as time of day, network location, or device security posture at the moment of the access request.

Question 2

Which OAuth 2.0 token type is a short-lived credential used to access protected resources on behalf of a user?

Accepted Answer

Access token

Answer

An access token is a short-lived credential presented by the client to the resource server to access protected resources on behalf of the resource owner.

Question 3

Which policy combining algorithm in XACML returns 'Deny' if any applicable policy returns 'Deny'?

Accepted Answer

Deny-overrides

Answer

The Deny-overrides combining algorithm returns Deny if any applicable policy or rule evaluates to Deny, prioritizing denial over permit decisions.

Question 4

What is the purpose of token introspection (RFC 7662) in OAuth 2.0?

Accepted Answer

To allow a resource server to validate and query metadata about a token

Answer

Token introspection allows a resource server to query the authorization server to determine whether a token is active and retrieve its metadata such as scope and expiration.

Question 5

In the context of federated identity and authorization, what does a 'relying party' depend on?

Accepted Answer

An identity provider's assertions about the user

Answer

A relying party (RP) trusts and depends on assertions or claims from an identity provider (IdP) to make authentication and authorization decisions rather than managing identity itself.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Authorization Frameworks 3