CIMP CIMP Access Management & Authentication 2 — Questions and Answers
Question 1: What is a Privileged Access Management (PAM) solution designed to protect?
- Standard user email accounts
- High-risk administrative and service accounts with elevated permissions (Correct answer)
- Public-facing web applications
- Guest Wi-Fi networks
Correct answer: High-risk administrative and service accounts with elevated permissions
PAM solutions vault, monitor, and control access to privileged accounts that have elevated permissions to critical systems, reducing the risk of insider threats and external attacks.
Question 2: Which protocol is most commonly used to enable federated identity across different organizations or cloud services?
- LDAP
- SAML (Security Assertion Markup Language) (Correct answer)
- FTP
- SNMP
Correct answer: SAML (Security Assertion Markup Language)
SAML is an XML-based open standard for exchanging authentication and authorization data between an identity provider and service providers across organizational boundaries.
Question 3: What is the purpose of an Identity Provider (IdP) in a federated identity model?
- To store application data for SaaS vendors
- To authenticate users and issue identity assertions that are trusted by service providers (Correct answer)
- To manage network routing between cloud services
- To generate API keys for developers
Correct answer: To authenticate users and issue identity assertions that are trusted by service providers
An IdP authenticates users and provides trusted assertions (tokens or assertions) about their identity and attributes to relying service providers.
Question 4: What does OAuth 2.0 primarily provide in modern access management?
- User authentication via username and password
- A delegated authorization framework allowing applications to access resources on behalf of a user without sharing credentials (Correct answer)
- Encryption of data at rest
- Certificate-based network authentication
Correct answer: A delegated authorization framework allowing applications to access resources on behalf of a user without sharing credentials
OAuth 2.0 enables third-party applications to obtain limited access to a user's resources without exposing the user's credentials, using access tokens.
Question 5: What is a 'session token' and why is proper management of it critical?
- A hardware device used for MFA
- A temporary credential issued after authentication that authorizes access during an active session, which must be protected from theft (Correct answer)
- A log entry generated after a failed login
- A certificate used to encrypt data in transit
Correct answer: A temporary credential issued after authentication that authorizes access during an active session, which must be protected from theft
Session tokens represent an authenticated session; if stolen, they can allow attackers to impersonate the user without needing their credentials.
Question 6: In PAM, what is 'just-in-time (JIT) access'?
- Automatically logging out inactive users
- Granting elevated privileges only for the duration needed to complete a specific task, then immediately revoking them (Correct answer)
- Pre-approving all admin access requests in advance
- Granting access based on the user's geographic location at login time
Correct answer: Granting elevated privileges only for the duration needed to complete a specific task, then immediately revoking them
JIT access eliminates standing privileges by provisioning elevated access only when needed and for a limited time, drastically reducing the window of exposure.
CIMP CIMP Access Management & Authentication 2
What is a Privileged Access Management (PAM) solution designed to protect?