CIAM Security and Risk Management 4

Question 1

A CIAM platform uses JSON Web Tokens (JWTs) for session management. Which vulnerability arises when JWT signature verification is bypassed by setting the algorithm to 'none'?

Accepted Answer

Algorithm confusion attack

Answer

The 'alg:none' algorithm confusion attack allows attackers to forge tokens by stripping signature validation entirely.

Question 2

Which security concept defines the maximum acceptable downtime for a CIAM authentication service before business operations are critically impacted?

Accepted Answer

Recovery Time Objective (RTO)

Answer

RTO defines the maximum tolerable length of time a system can be offline before the impact becomes unacceptable to the business.

Question 3

What is the PRIMARY risk of allowing users to self-register without any verification in a CIAM system?

Accepted Answer

Account enumeration and fake account creation enabling fraud

Answer

Unverified self-registration enables fraudsters to create fake accounts for fraud, spam, or credential-stuffing cover.

Question 4

Which principle requires that critical IAM tasks, such as provisioning and approving access, be divided between two or more individuals?

Accepted Answer

Separation of duties

Answer

Separation of duties prevents a single person from having end-to-end control over a critical process, reducing fraud and error risk.

Question 5

An organization classifies its CIAM data as 'Confidential.' What does this classification PRIMARILY dictate?

Accepted Answer

The handling, storage, transmission, and disposal controls required for that data

Answer

Data classification determines the security controls and handling procedures that must be applied throughout the data lifecycle.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Security and Risk Management 4