Identity and Access Management Flashcards

When implementing emergency 'break-glass' accounts, what is the recommended security approach?

Answer: Store credentials in secured physical or digital storage with all access events logged and reviewed

Break-glass accounts must balance emergency accessibility with strict accountability, requiring tightly controlled credential storage and mandatory review of every access event.

What is the purpose of step-up authentication in a risk-adaptive IAM system?

Answer: To require stronger authentication when accessing higher-risk resources or performing sensitive operations

Step-up authentication triggers additional verification factors when users attempt high-value or sensitive operations, matching authentication strength to the risk of the specific action.

Which NIST publication defines Identity Assurance Levels (IAL), Authentication Assurance Levels (AAL), and Federation Assurance Levels (FAL)?

Answer: NIST SP 800-63

NIST SP 800-63 (Digital Identity Guidelines) establishes the assurance level framework covering identity proofing (IAL), authentication strength (AAL), and federation trust (FAL).

In cloud environments, what is the primary security consequence of misconfigured IAM policies?

Answer: Overly permissive access leading to unauthorized resource access or large-scale data breaches

Cloud IAM misconfigurations commonly grant excessive permissions, enabling attackers or malicious insiders to access, exfiltrate, or destroy sensitive data far beyond intended scope.

In an Identity Governance and Administration (IGA) solution, how does identity governance differ from access management?

Answer: Identity governance focuses on policy compliance and access certification; access management handles real-time enforcement

IGA governance provides oversight through policy definition, access certifications, and compliance reporting, while the access management component enforces those policies at runtime.

Which technique most effectively prevents token replay attacks in an OAuth 2.0 implementation?

Answer: Implementing short-lived access tokens combined with refresh token rotation that invalidates used tokens

Short-lived access tokens limit exposure windows, and refresh token rotation invalidates a refresh token after each use, ensuring stolen refresh tokens cannot be replayed by attackers.

What is the primary security advantage of FIDO2/WebAuthn over traditional password-based or SMS-based MFA?

Answer: It provides phishing-resistant authentication by cryptographically binding credentials to the specific website origin

FIDO2/WebAuthn credentials are origin-bound — the credential only works on the legitimate site, making phishing attacks ineffective because stolen assertions cannot be used on the real site.