Identity and Access Management Flashcards

What is the primary security benefit of implementing Just-In-Time (JIT) privileged access?

Answer: It reduces the attack window by granting elevated privileges only when needed for a defined period

JIT access minimizes the time elevated privileges are active, significantly reducing the window of opportunity for credential theft and misuse.

In OAuth 2.0, what is the security advantage of the authorization code flow over the implicit flow?

Answer: It exchanges a short-lived code for tokens via the back channel, keeping tokens out of the browser

The authorization code flow exchanges a temporary code for tokens over a secure back channel, preventing tokens from being exposed in browser history or redirects.

What distinguishes Attribute-Based Access Control (ABAC) from Role-Based Access Control (RBAC)?

Answer: ABAC evaluates multiple attributes (user, resource, environment) for finer-grained decisions vs. RBAC's static role assignments

ABAC evaluates combinations of user attributes, resource sensitivity, and environmental conditions, enabling context-aware access decisions beyond what static roles can express.

Which solution provides centralized management, session monitoring, and credential vaulting for privileged accounts?

Answer: Privileged Access Management (PAM)

PAM solutions provide credential vaulting, session recording, just-in-time access, and centralized oversight specifically for privileged accounts and administrative access.

What is the primary risk mitigated by implementing rigorous account lifecycle management?

Answer: Orphaned accounts retaining access after employees leave or change roles

Without account lifecycle management, former employees or role-changers retain access through orphaned accounts, creating unauthorized access risks that may go undetected for extended periods.

In federated identity, what is the role of an Identity Provider (IdP)?

Answer: To authenticate users and issue identity assertions that Service Providers trust to grant access

The IdP is the authoritative source that authenticates users and issues signed assertions or tokens that relying Service Providers accept to grant access without re-authenticating.

What is credential stuffing, and which IAM control most effectively mitigates it?

Answer: Using stolen username/password pairs from data breaches to log into other services; multi-factor authentication

Credential stuffing uses breached credentials from other sites to exploit password reuse; MFA stops the attack even when valid credentials are submitted by the attacker.