CISSP Identity and Access Management 5

Question 1

Which IAM concept uses continuous evaluation of user behavior, device health, and context to make per-request access decisions rather than trusting the network perimeter?

Accepted Answer

Zero trust architecture

Answer

Zero trust architecture assumes no implicit trust based on network location and requires continuous verification of identity, device posture, and context for every access request.

Question 2

A company discovers that a former employee's Active Directory account was disabled but their VPN certificate was never revoked. Which process failed?

Accepted Answer

Account de-provisioning / offboarding

Answer

Incomplete de-provisioning — failing to revoke all credentials including certificates — leaves residual access vectors open after an employee departs.

Question 3

Which Kerberos attack forges a TGT using the compromised KRBTGT account hash, granting the attacker persistent and nearly unlimited domain access?

Accepted Answer

Golden ticket attack

Answer

A golden ticket attack uses the KRBTGT password hash to forge valid TGTs for any account, effectively giving the attacker domain-level persistence.

Question 4

An organization implements context-aware authentication that increases scrutiny when login attempts occur from unusual countries. Which authentication approach does this describe?

Accepted Answer

Adaptive / risk-based authentication

Answer

Adaptive (risk-based) authentication dynamically adjusts the level of authentication challenge based on contextual risk signals such as location, device, or behavior anomalies.

Question 5

Which standard defines a common framework for assurance levels in digital identity, classifying them as IAL, AAL, and FAL?

Accepted Answer

NIST SP 800-63

Answer

NIST SP 800-63 Digital Identity Guidelines defines Identity Assurance Level (IAL), Authenticator Assurance Level (AAL), and Federation Assurance Level (FAL).

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Identity and Access Management 5