CISSP Identity and Access Management 5 — Questions and Answers
Question 1: Which IAM concept uses continuous evaluation of user behavior, device health, and context to make per-request access decisions rather than trusting the network perimeter?
- Defense in depth
- Zero trust architecture (Correct answer)
- Perimeter-based security
- Network segmentation
Correct answer: Zero trust architecture
Zero trust architecture assumes no implicit trust based on network location and requires continuous verification of identity, device posture, and context for every access request.
Question 2: A company discovers that a former employee's Active Directory account was disabled but their VPN certificate was never revoked. Which process failed?
- User provisioning
- Account de-provisioning / offboarding (Correct answer)
- Access recertification
- Role mining
Correct answer: Account de-provisioning / offboarding
Incomplete de-provisioning — failing to revoke all credentials including certificates — leaves residual access vectors open after an employee departs.
Question 3: Which Kerberos attack forges a TGT using the compromised KRBTGT account hash, granting the attacker persistent and nearly unlimited domain access?
- Kerberoasting
- Pass-the-ticket
- Silver ticket attack
- Golden ticket attack (Correct answer)
Correct answer: Golden ticket attack
A golden ticket attack uses the KRBTGT password hash to forge valid TGTs for any account, effectively giving the attacker domain-level persistence.
Question 4: An organization implements context-aware authentication that increases scrutiny when login attempts occur from unusual countries. Which authentication approach does this describe?
- Adaptive / risk-based authentication (Correct answer)
- Time-based OTP
- Step-up authentication
- Attribute-based access control
Correct answer: Adaptive / risk-based authentication
Adaptive (risk-based) authentication dynamically adjusts the level of authentication challenge based on contextual risk signals such as location, device, or behavior anomalies.
Question 5: Which standard defines a common framework for assurance levels in digital identity, classifying them as IAL, AAL, and FAL?
- ISO/IEC 27001
- NIST SP 800-63 (Correct answer)
- FIPS 140-3
- PCI DSS
Correct answer: NIST SP 800-63
NIST SP 800-63 Digital Identity Guidelines defines Identity Assurance Level (IAL), Authenticator Assurance Level (AAL), and Federation Assurance Level (FAL).
Question 6: Which technique involves mapping existing user permissions to derive a normalized, minimal set of roles that covers the organization's access needs?
- Access recertification
- Entitlement explosion
- Role mining (Correct answer)
- Permission inheritance
Correct answer: Role mining
Role mining analyzes existing user-to-permission assignments to discover natural role groupings, enabling organizations to build RBAC structures from real access patterns.
Question 7: A user is authenticated but the system checks additional attributes — department, project membership, and data sensitivity level — before granting access to a document. Which model is being applied?
- Role-based access control
- Discretionary access control
- Attribute-based access control (Correct answer)
- Mandatory access control
Correct answer: Attribute-based access control
ABAC evaluates multiple attributes of the subject, resource, and environment simultaneously to make fine-grained access decisions beyond simple role membership.
CISSP Identity and Access Management 5
Which IAM concept uses continuous evaluation of user behavior, device health, and context to make per-request access decisions rather than trusting the network perimeter?