CIAM Identity Proofing and Verification 2 — Questions and Answers
Question 1: NIST SP 800-63A's IAL3 (Identity Assurance Level 3) requires which verification method not mandated at IAL2?
- Remote document scanning
- Knowledge-based authentication
- In-person proofing with a trained operator or Trusted Referee (Correct answer)
- Self-assertion of identity attributes
Correct answer: In-person proofing with a trained operator or Trusted Referee
IAL3 requires in-person proofing (or an equivalent supervised remote session) conducted by a trained operator, providing the highest level of confidence in the identity being established.
Question 2: What is 'synthetic identity fraud' in the context of identity proofing?
- Using stolen credentials to impersonate an existing individual
- Creating a fictitious identity by combining real and fabricated personally identifiable information (Correct answer)
- Forging physical identity documents for in-person proofing
- Replaying captured biometric data to defeat liveness detection
Correct answer: Creating a fictitious identity by combining real and fabricated personally identifiable information
Synthetic identity fraud involves constructing a fake identity by blending real information (e.g., a legitimate Social Security Number) with fabricated details, making it harder to detect than traditional identity theft.
Question 3: During remote identity proofing at IAL2, which of the following is typically required?
- Submission of a handwritten notarized affidavit
- Automated validation of identity document images and a selfie comparison (Correct answer)
- In-person biometric capture at a government office
- An existing federated identity from a social media provider
Correct answer: Automated validation of identity document images and a selfie comparison
Remote IAL2 proofing typically requires the applicant to capture images of a government-issued identity document and a selfie, which are then validated and compared using automated systems.
Question 4: What does 'document authenticity verification' aim to confirm during identity proofing?
- That the document's expiration date is in the future
- That the identity document is genuine and has not been tampered with or forged (Correct answer)
- That the document matches the format preferred by the relying party
- That the document has been scanned at sufficient resolution
Correct answer: That the identity document is genuine and has not been tampered with or forged
Document authenticity verification checks security features, holograms, machine-readable zones, and other indicators to confirm a presented document is genuine and unaltered.
Question 5: Which type of attack specifically targets identity proofing systems by submitting fraudulent or stolen identity documents?
- Credential stuffing
- Identity document fraud (Correct answer)
- Session hijacking
- SQL injection
Correct answer: Identity document fraud
Identity document fraud involves presenting counterfeit, altered, or stolen documents during the proofing process in an attempt to fraudulently establish a new identity.
Question 6: In NIST SP 800-63A, which term describes the process of determining that the identity evidence provided refers to a single, unique individual?
- Identity validation
- Identity binding
- Identity resolution (Correct answer)
- Identity federation
Correct answer: Identity resolution
Identity resolution is the process of using the collected evidence to determine that the identity refers to a unique individual, distinguishing the applicant from all others in a population.
Question 7: What is the key distinction between IAL1 and IAL2 per NIST SP 800-63A?
- IAL1 requires multi-factor authentication while IAL2 uses single-factor
- IAL1 allows self-asserted identity with no proofing while IAL2 requires validated identity evidence (Correct answer)
- IAL1 mandates biometrics while IAL2 uses knowledge factors only
- IAL1 is for federal systems while IAL2 applies to commercial entities
Correct answer: IAL1 allows self-asserted identity with no proofing while IAL2 requires validated identity evidence
At IAL1, there is no requirement to link the applicant's claimed identity to the real world; at IAL2, the identity must be supported by validated and verified evidence.
CIAM Identity Proofing and Verification 2
NIST SP 800-63A's IAL3 (Identity Assurance Level 3) requires which verification method not mandated at IAL2?