CIAM Foundational Frameworks 2 — Questions and Answers
Question 1: Which NIST publication provides the primary guidance for digital identity risk management and defines assurance levels?
- NIST SP 800-53
- NIST SP 800-63 (Correct answer)
- NIST SP 800-37
- NIST SP 800-30
Correct answer: NIST SP 800-63
NIST SP 800-63 defines Identity Assurance Level (IAL), Authenticator Assurance Level (AAL), and Federation Assurance Level (FAL).
Question 2: Under the Zero Trust Architecture framework, which principle states that no user or device should be inherently trusted regardless of network location?
- Least privilege access
- Never trust, always verify (Correct answer)
- Assume breach
- Microsegmentation
Correct answer: Never trust, always verify
The 'never trust, always verify' principle is the foundational tenet of Zero Trust, requiring continuous authentication and authorization.
Question 3: In the OAuth 2.0 framework, what is the role of the Authorization Server?
- Hosts protected resources
- Issues access tokens after authenticating the resource owner (Correct answer)
- Stores user credentials in a directory
- Validates TLS certificates for API calls
Correct answer: Issues access tokens after authenticating the resource owner
The Authorization Server authenticates the resource owner and issues access tokens to the client after obtaining authorization.
Question 4: Which identity governance concept ensures that a user's access rights are reviewed and confirmed by an authoritative party at regular intervals?
- Segregation of duties
- Access certification (Correct answer)
- Role mining
- Entitlement harvesting
Correct answer: Access certification
Access certification (access review/recertification) is the periodic process of validating that users still require their current access rights.
Question 5: The SCIM (System for Cross-domain Identity Management) protocol is primarily used for which purpose?
- Encrypting identity tokens in transit
- Automating user provisioning and deprovisioning across systems (Correct answer)
- Federating authentication between identity providers
- Signing SAML assertions for SSO
Correct answer: Automating user provisioning and deprovisioning across systems
SCIM provides a standardized REST-based API for automating the exchange of user identity information between identity domains.
Question 6: Which framework uses a maturity model with five levels (Initial, Managed, Defined, Quantitatively Managed, Optimizing) applicable to IAM process improvement?
- COBIT 2019
- CMMI (Correct answer)
- ISO/IEC 27001
- ITIL 4
Correct answer: CMMI
CMMI (Capability Maturity Model Integration) defines five process maturity levels used to assess and improve organizational processes including IAM.
Question 7: In a federated identity model, what is an Identity Provider (IdP) responsible for?
- Enforcing authorization policies at the resource
- Authenticating users and asserting their identity to service providers (Correct answer)
- Storing encrypted passwords for all federated users
- Issuing X.509 certificates to relying parties
Correct answer: Authenticating users and asserting their identity to service providers
The IdP authenticates users and issues identity assertions (e.g., SAML assertions or OIDC tokens) that relying parties trust.
CIAM Foundational Frameworks 2
Which NIST publication provides the primary guidance for digital identity risk management and defines assurance levels?