CISSP Identity and Access Management 3

Question 1

Which OAuth 2.0 grant type is most appropriate for a server-side web application that can securely store a client secret?

Accepted Answer

Authorization Code Grant

Answer

The Authorization Code Grant is the most secure OAuth 2.0 flow for server-side apps because it exchanges a short-lived code for tokens without exposing them in the browser.

Question 2

A privileged access management (PAM) solution stores administrator passwords and rotates them after each use. Which PAM capability does this describe?

Accepted Answer

Password vaulting with check-out

Answer

Password vaulting with check-out allows admins to retrieve a password for one session; the vault automatically rotates it afterward, preventing password reuse.

Question 3

Which directory protocol is most commonly used for querying and modifying user account information in enterprise environments?

Accepted Answer

LDAP

Answer

LDAP (Lightweight Directory Access Protocol) is the standard protocol for reading and writing to directory services like Active Directory.

Question 4

A user requests elevated privileges only for the duration needed to perform a specific administrative task. Which concept does this represent?

Accepted Answer

Just-in-time privileged access

Answer

Just-in-time (JIT) privileged access grants elevated rights only when needed and revokes them immediately after, minimizing the window of exposure.

Question 5

When an organization uses an external IdP to authenticate users and the application trusts that IdP's assertions, what is the application called?

Accepted Answer

Service Provider

Answer

In federated identity, the Service Provider (SP) relies on the Identity Provider (IdP) to authenticate users and accepts the IdP's identity assertions.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Identity and Access Management 3