CIMP Technology & Tools 5 — Questions and Answers
Question 1: Which RADIUS capability makes it widely used for network access authentication?
- Centralized AAA for VPN, Wi-Fi, and network devices (Correct answer)
- Federated web SSO via XML assertions
- Directory schema management
- Certificate issuance
Correct answer: Centralized AAA for VPN, Wi-Fi, and network devices
RADIUS provides centralized authentication, authorization, and accounting for network access.
Question 2: What is the key difference between TACACS+ and RADIUS?
- TACACS+ separates authentication, authorization, and accounting and encrypts the full packet body (Correct answer)
- TACACS+ uses UDP only
- RADIUS encrypts the entire payload
- TACACS+ is used only for web SSO
Correct answer: TACACS+ separates authentication, authorization, and accounting and encrypts the full packet body
TACACS+ runs over TCP, decouples the AAA functions, and encrypts the whole body, favored for device administration.
Question 3: Which concept allows a user to maintain a single set of credentials across multiple systems, with each system still authenticating separately?
- Same sign-on (Correct answer)
- Single sign-on
- Federated logout
- Token binding
Correct answer: Same sign-on
Same sign-on uses identical credentials but requires re-authentication per system, unlike true SSO.
Question 4: A service account used by an application should ideally be managed how?
- Vaulted with automated rotation and least privilege (Correct answer)
- Shared among administrators via spreadsheet
- Granted domain admin for convenience
- Left with a non-expiring static password
Correct answer: Vaulted with automated rotation and least privilege
Service accounts should be inventoried, vaulted, rotated, and limited to required permissions.
Question 5: Which technology uses attributes of the user, resource, and environment to make access decisions at runtime?
- Attribute-based access control (Correct answer)
- Discretionary access control lists only
- Mandatory lattice labels only
- Static group membership
Correct answer: Attribute-based access control
ABAC evaluates policies over subject, resource, action, and environment attributes dynamically.
Question 6: What is a primary benefit of using a hardware security module (HSM) in an identity infrastructure?
- Tamper-resistant protection of private keys such as CA or token signing keys (Correct answer)
- Faster user provisioning
- Automatic role mining
- Replacing the directory
Correct answer: Tamper-resistant protection of private keys such as CA or token signing keys
HSMs store and use cryptographic keys inside hardened hardware, protecting signing keys from extraction.
Question 7: In a PKI used for identity, what does an OCSP responder do?
- Reports the revocation status of a certificate in real time (Correct answer)
- Issues new root certificates
- Generates user passwords
- Stores private keys for users
Correct answer: Reports the revocation status of a certificate in real time
OCSP lets relying parties check whether a specific certificate has been revoked without downloading a full CRL.
