CIAM Technology and Tools 3 — Questions and Answers
Question 1: An enterprise deploys a tool that analyzes user behavior baselines and flags anomalous access patterns. What category does this tool fall under?
- Directory Services
- User and Entity Behavior Analytics (UEBA) (Correct answer)
- Public Key Infrastructure (PKI)
- LDAP proxy
Correct answer: User and Entity Behavior Analytics (UEBA)
UEBA tools use machine learning to establish behavioral baselines and detect anomalies that may indicate compromised accounts.
Question 2: Which component of a CIAM platform is responsible for managing the user registration and self-service profile update experience?
- Token introspection endpoint
- Identity Provider (IdP) broker
- Customer-facing identity portal / self-service UI (Correct answer)
- RADIUS server
Correct answer: Customer-facing identity portal / self-service UI
The customer-facing identity portal handles self-registration, profile management, and consent collection for end consumers.
Question 3: What is the function of an OAuth 2.0 authorization server's 'token introspection' endpoint?
- To issue new access tokens to clients
- To allow resource servers to validate and inspect active tokens (Correct answer)
- To refresh expired refresh tokens
- To register new OAuth clients
Correct answer: To allow resource servers to validate and inspect active tokens
Token introspection (RFC 7662) lets a resource server query the authorization server to determine whether a token is active and retrieve its metadata.
Question 4: In a federated identity model, which entity makes the authentication decision and asserts the user's identity to a relying party?
- The relying party (RP)
- The resource server
- The Identity Provider (IdP) (Correct answer)
- The LDAP directory
Correct answer: The Identity Provider (IdP)
The Identity Provider authenticates the user and issues assertions (e.g., SAML or OIDC tokens) to the relying party.
Question 5: Which PKI component is used to declare that a previously issued certificate should no longer be trusted before its expiration?
- Certificate Signing Request (CSR)
- Online Certificate Status Protocol (OCSP) responder
- Certificate Revocation List (CRL) or OCSP (Correct answer)
- Root Certificate Authority
Correct answer: Certificate Revocation List (CRL) or OCSP
A CRL or OCSP provides revocation status so relying parties know whether a certificate has been invalidated before its natural expiry.
Question 6: Which deployment model for an IAM solution places the IAM infrastructure entirely within the organization's own data center?
- SaaS (cloud-hosted)
- On-premises (Correct answer)
- Hybrid
- Multi-tenant cloud
Correct answer: On-premises
An on-premises IAM deployment runs all IAM components within the organization's own infrastructure, giving full control but requiring internal maintenance.
Question 7: What technology allows passwordless authentication by using a private key stored on a device and a public key registered with a service?
- Kerberos
- FIDO2 / WebAuthn (Correct answer)
- RADIUS
- NTLM
Correct answer: FIDO2 / WebAuthn
FIDO2/WebAuthn uses asymmetric cryptography where the private key never leaves the device, enabling phishing-resistant passwordless login.
CIAM Technology and Tools 3
An enterprise deploys a tool that analyzes user behavior baselines and flags anomalous access patterns.
What category does this tool fall under?