CISSP Identity and Access Management 3 — Questions and Answers
Question 1: Which OAuth 2.0 grant type is most appropriate for a server-side web application that can securely store a client secret?
- Implicit Grant
- Client Credentials Grant
- Authorization Code Grant (Correct answer)
- Device Authorization Grant
Correct answer: Authorization Code Grant
The Authorization Code Grant is the most secure OAuth 2.0 flow for server-side apps because it exchanges a short-lived code for tokens without exposing them in the browser.
Question 2: A privileged access management (PAM) solution stores administrator passwords and rotates them after each use. Which PAM capability does this describe?
- Just-in-time access
- Session recording
- Password vaulting with check-out (Correct answer)
- Privilege elevation
Correct answer: Password vaulting with check-out
Password vaulting with check-out allows admins to retrieve a password for one session; the vault automatically rotates it afterward, preventing password reuse.
Question 3: Which directory protocol is most commonly used for querying and modifying user account information in enterprise environments?
- RADIUS
- LDAP (Correct answer)
- TACACS+
- DIAMETER
Correct answer: LDAP
LDAP (Lightweight Directory Access Protocol) is the standard protocol for reading and writing to directory services like Active Directory.
Question 4: A user requests elevated privileges only for the duration needed to perform a specific administrative task. Which concept does this represent?
- Role-based access control
- Just-in-time privileged access (Correct answer)
- Mandatory access control
- Identity federation
Correct answer: Just-in-time privileged access
Just-in-time (JIT) privileged access grants elevated rights only when needed and revokes them immediately after, minimizing the window of exposure.
Question 5: When an organization uses an external IdP to authenticate users and the application trusts that IdP's assertions, what is the application called?
- Identity Broker
- Identity Provider
- Service Provider (Correct answer)
- Resource Server
Correct answer: Service Provider
In federated identity, the Service Provider (SP) relies on the Identity Provider (IdP) to authenticate users and accepts the IdP's identity assertions.
Question 6: Which attack exploits the reuse of a previously captured authentication token to impersonate a legitimate user?
- Pass-the-hash
- Replay attack (Correct answer)
- Brute-force attack
- Credential stuffing
Correct answer: Replay attack
A replay attack intercepts and reuses a valid authentication token or message to gain unauthorized access without knowing the original credentials.
Question 7: Which identity governance function periodically reviews whether existing user access rights remain appropriate and business-justified?
- User provisioning
- Access recertification (certification campaign) (Correct answer)
- Role mining
- Entitlement management
Correct answer: Access recertification (certification campaign)
Access recertification (also called access certification campaigns) requires managers to review and confirm or revoke their team members' existing access rights periodically.
CISSP Identity and Access Management 3
Which OAuth 2.0 grant type is most appropriate for a server-side web application that can securely store a client secret?