CIMP Access Management & Authentication Flashcards

What is passwordless authentication, and which technology is commonly used to implement it?

Answer: Authentication that replaces passwords with alternatives like biometrics or hardware keys, commonly using the FIDO2/WebAuthn standard

Passwordless authentication eliminates password-related risks by using FIDO2/WebAuthn-based methods such as biometrics, passkeys, or hardware security keys.

What is 'continuous authentication' in modern access management?

Answer: Ongoing verification of user identity throughout a session by monitoring behavioral signals like typing patterns and mouse movements

Continuous authentication monitors user behavior throughout a session to detect anomalies that may indicate the session has been taken over by an unauthorized party.

Which access management concept enforces that users can only access resources from approved devices that meet security standards?

Answer: Device trust or device compliance enforcement

Device trust policies ensure that only managed, compliant devices (with up-to-date patches, encryption, and MDM enrollment) are permitted to access sensitive resources.

What is the Zero Trust security model's core principle as it applies to access management?

Answer: Never trust, always verify — authenticate and authorize every request regardless of network location

Zero Trust assumes no implicit trust based on network location and requires continuous verification of identity, device health, and context for every access request.

What role does an Access Management audit log play in a CIMP professional's responsibilities?

Answer: It provides a tamper-evident record of authentication events and access decisions used for forensic investigation and compliance reporting

Audit logs capture who accessed what, when, and from where, enabling security investigations, compliance audits, and detection of anomalous behavior.

In the US public sector, which framework provides guidance on identity and access management requirements for federal agencies?

Answer: NIST Special Publication 800-63 (Digital Identity Guidelines)

NIST SP 800-63 provides the federal standard for digital identity, defining assurance levels for identity proofing, authentication, and federation used by US government agencies.