CSI Security Architecture & IAM 2 — Questions and Answers
Question 1: Which IAM concept ensures that a user's access rights are automatically revoked when they change roles within an organization?
- Separation of duties
- Privilege creep prevention through role recertification (Correct answer)
- Mandatory access control
- Discretionary access control
Correct answer: Privilege creep prevention through role recertification
Role recertification processes periodically review and revoke accumulated access rights that no longer match a user's current role, preventing privilege creep.
Question 2: In a Zero Trust Architecture, what is the primary function of a Policy Decision Point (PDP)?
- Encrypting data in transit
- Evaluating access requests against policy and issuing authorization decisions (Correct answer)
- Storing user credentials
- Managing network firewall rules
Correct answer: Evaluating access requests against policy and issuing authorization decisions
The PDP evaluates each access request against defined policies and context attributes, then issues allow or deny decisions to the Policy Enforcement Point.
Question 3: An organization wants to federate identity between their on-premises Active Directory and a cloud SaaS provider. Which protocol is MOST appropriate?
- LDAP
- SAML 2.0 (Correct answer)
- RADIUS
- Kerberos
Correct answer: SAML 2.0
SAML 2.0 is the standard protocol for federated identity across organizational boundaries, enabling single sign-on between enterprise identity providers and cloud SaaS applications.
Question 4: What distinguishes attribute-based access control (ABAC) from role-based access control (RBAC)?
- ABAC uses static group memberships while RBAC uses dynamic rules
- ABAC evaluates multiple contextual attributes at runtime while RBAC grants access based on predefined roles (Correct answer)
- ABAC is only used for network resources while RBAC applies to applications
- ABAC requires hardware tokens while RBAC uses software only
Correct answer: ABAC evaluates multiple contextual attributes at runtime while RBAC grants access based on predefined roles
ABAC makes access decisions by evaluating combinations of user, resource, and environmental attributes at runtime, enabling much finer-grained control than static RBAC role assignments.
Question 5: Which security architecture pattern places authentication and authorization logic at the edge of the network, before traffic reaches backend services?
- Defense in depth
- API gateway with OAuth 2.0 token validation (Correct answer)
- Network segmentation
- Data loss prevention
Correct answer: API gateway with OAuth 2.0 token validation
An API gateway acts as the perimeter enforcement point, validating OAuth 2.0 tokens and enforcing authorization policies before requests reach microservices or backend systems.
Question 6: A CSI is designing a privileged access management (PAM) solution. Which capability is MOST critical for reducing insider threat risk?
- Password complexity requirements
- Session recording and just-in-time privilege elevation (Correct answer)
- Multi-factor authentication for all users
- Network-level access control lists
Correct answer: Session recording and just-in-time privilege elevation
Session recording provides audit trails of privileged activity, while just-in-time elevation minimizes the window of exposure by granting elevated rights only when needed.
Question 7: When implementing PKI for an enterprise, what is the recommended approach for protecting the Root CA private key?
- Store it on a password-protected USB drive
- Keep it offline in a Hardware Security Module (HSM) in a physically secured facility (Correct answer)
- Replicate it across multiple active servers for availability
- Use a cloud key management service for easy access
Correct answer: Keep it offline in a Hardware Security Module (HSM) in a physically secured facility
The Root CA key should be kept offline in an HSM within a physically secured, access-controlled facility to prevent compromise since it is the ultimate trust anchor for the entire PKI.
CSI Security Architecture & IAM 2
Which IAM concept ensures that a user's access rights are automatically revoked when they change roles within an organization?