CISSP Identity and Access Management 4

Question 1

Which type of token used in OAuth 2.0 / OIDC contains encoded claims about the user and can be validated without contacting the authorization server?

Accepted Answer

JSON Web Token (JWT)

Answer

JWTs are self-contained tokens that embed claims as a signed JSON payload, allowing resource servers to validate them locally without a round-trip to the authorization server.

Question 2

A CISSP candidate reviews a system where subjects access objects based on their security clearance and object classification labels. Which model is in use?

Accepted Answer

Bell-LaPadula

Answer

The Bell-LaPadula model enforces confidentiality by requiring that subjects only read at or below their clearance level (no read-up) and write at or above their clearance level (no write-down).

Question 3

Which protocol extends RADIUS capabilities to support mobile and distributed network authentication with better reliability and security?

Accepted Answer

DIAMETER

Answer

DIAMETER is the successor to RADIUS, offering improved reliability (TCP/SCTP), better error handling, and enhanced security features for AAA services.

Question 4

An attacker compromises a low-privilege account and uses it to request a service ticket for a high-privilege account, then cracks the ticket offline. What attack is this?

Accepted Answer

Kerberoasting

Answer

Kerberoasting exploits Kerberos by requesting service tickets for accounts with SPNs and cracking them offline to recover plaintext passwords.

Question 5

Which access provisioning approach reduces risk by granting users only the minimum permissions required for their specific job responsibilities?

Accepted Answer

Least privilege

Answer

The principle of least privilege restricts user access rights to only what is necessary to perform their job, reducing the attack surface if the account is compromised.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Identity and Access Management 4