CISSP Identity and Access Management 2 — Questions and Answers
Question 1: Which federation standard allows identity assertions to be passed between domains using XML-based tokens?
- OAuth 2.0
- SAML 2.0 (Correct answer)
- OpenID Connect
- Kerberos
Correct answer: SAML 2.0
SAML 2.0 (Security Assertion Markup Language) uses XML-based assertions to communicate identity information between identity providers and service providers across domains.
Question 2: A user's access rights should be immediately revoked when they leave the organization. Which IAM process ensures this happens consistently?
- Access recertification
- User provisioning
- De-provisioning workflows (Correct answer)
- Segregation of duties
Correct answer: De-provisioning workflows
De-provisioning workflows automate the removal of access rights, accounts, and credentials when a user's employment or role ends.
Question 3: Which access control model assigns permissions based on rules evaluated against environmental conditions such as time of day or location?
- MAC
- DAC
- ABAC (Correct answer)
- RBAC
Correct answer: ABAC
Attribute-Based Access Control (ABAC) evaluates policies using attributes of the subject, resource, and environment — including contextual conditions like time or location.
Question 4: An organization wants to prevent a single administrator from having both the ability to create accounts and approve their own access requests. Which principle addresses this?
- Least privilege
- Need to know
- Segregation of duties (Correct answer)
- Defense in depth
Correct answer: Segregation of duties
Segregation of duties (SoD) divides critical tasks between multiple people to prevent fraud and error by ensuring no single person controls an entire process.
Question 5: Which Kerberos component issues Ticket Granting Tickets (TGTs) after authenticating a user's credentials?
- Service Principal
- Key Distribution Center (Correct answer)
- Ticket Granting Server
- Authentication Agent
Correct answer: Key Distribution Center
The Key Distribution Center (KDC) contains the Authentication Server (AS) that validates credentials and issues TGTs used to request service tickets.
Question 6: What term describes the practice of using a single set of credentials to access multiple independent systems without re-authenticating?
- Multi-factor authentication
- Single sign-on (Correct answer)
- Federated identity
- Credential delegation
Correct answer: Single sign-on
Single sign-on (SSO) allows users to authenticate once and gain access to multiple systems without entering credentials again for each application.
Question 7: Which biometric error rate represents the probability that an unauthorized user is incorrectly granted access?
- False Rejection Rate
- Crossover Error Rate
- False Acceptance Rate (Correct answer)
- Equal Error Rate
Correct answer: False Acceptance Rate
The False Acceptance Rate (FAR) measures how often the biometric system accepts an unauthorized individual, representing a security failure.
CISSP Identity and Access Management 2
Which federation standard allows identity assertions to be passed between domains using XML-based tokens?