CSI Security Architecture & IAM 3 — Questions and Answers
Question 1: In OAuth 2.0, which grant type is MOST appropriate for a server-to-server API integration where no user interaction is involved?
- Authorization Code
- Client Credentials (Correct answer)
- Implicit
- Device Authorization
Correct answer: Client Credentials
The Client Credentials grant type is designed for machine-to-machine authentication where the client acts on its own behalf without delegating user permissions.
Question 2: Which identity governance capability ensures that toxic combinations of access rights are not granted to the same individual?
- Access certification
- Separation of duties (SoD) policy enforcement (Correct answer)
- Privileged identity management
- Identity lifecycle management
Correct answer: Separation of duties (SoD) policy enforcement
SoD policy enforcement detects and prevents scenarios where a single user holds conflicting permissions that together could enable fraud or bypass controls.
Question 3: A security architect is evaluating trust levels in a multi-cloud environment. What is the purpose of a Cloud Access Security Broker (CASB)?
- Replacing on-premises firewalls with cloud-native alternatives
- Providing visibility, compliance, and threat protection for cloud service usage (Correct answer)
- Managing virtual machine lifecycle in public clouds
- Encrypting all inter-cloud network traffic
Correct answer: Providing visibility, compliance, and threat protection for cloud service usage
A CASB sits between users and cloud services to enforce security policies, provide visibility into shadow IT, ensure compliance, and detect threats across SaaS, IaaS, and PaaS.
Question 4: During a security architecture review, a CSI discovers that service accounts share the same credentials. What is the PRIMARY risk this creates?
- Reduced system performance due to authentication overhead
- Inability to attribute actions to specific services, complicating breach investigation and containment (Correct answer)
- Increased licensing costs for identity management software
- Slower patch deployment cycles
Correct answer: Inability to attribute actions to specific services, complicating breach investigation and containment
Shared credentials prevent attribution of individual service actions, make credential rotation difficult, and mean that a single compromised credential affects multiple services simultaneously.
Question 5: What is the security significance of certificate pinning in mobile application architecture?
- It reduces the size of TLS handshake packets
- It prevents man-in-the-middle attacks by binding the app to a specific certificate or public key (Correct answer)
- It eliminates the need for a public CA
- It enables certificate auto-renewal without user interaction
Correct answer: It prevents man-in-the-middle attacks by binding the app to a specific certificate or public key
Certificate pinning embeds the expected server certificate or public key in the app, so even a rogue certificate from a trusted CA will be rejected, preventing interception.
Question 6: In a defense-in-depth security architecture, what layer does data classification PRIMARILY support?
- Perimeter security layer
- Data security layer — enforcing controls proportionate to data sensitivity (Correct answer)
- Application security layer
- Physical security layer
Correct answer: Data security layer — enforcing controls proportionate to data sensitivity
Data classification identifies sensitivity levels, which drives the data security layer's encryption requirements, access controls, retention policies, and handling procedures.
Question 7: An enterprise is migrating to passwordless authentication. Which combination of factors meets FIDO2 WebAuthn requirements?
- Smart card plus PIN transmitted over HTTPS
- Platform authenticator or roaming authenticator with cryptographic user verification (Correct answer)
- One-time password sent via SMS combined with username
- Biometric template stored on a central server with local matching
Correct answer: Platform authenticator or roaming authenticator with cryptographic user verification
FIDO2 WebAuthn uses public-key cryptography with authenticators (platform built-in or external roaming) that perform user verification locally, never transmitting secrets to the server.
CSI Security Architecture & IAM 3
In OAuth 2.0, which grant type is MOST appropriate for a server-to-server API integration where no user interaction is involved?