CSI Security Architecture & IAM 3

Question 1

In OAuth 2.0, which grant type is MOST appropriate for a server-to-server API integration where no user interaction is involved?

Accepted Answer

Client Credentials

Answer

The Client Credentials grant type is designed for machine-to-machine authentication where the client acts on its own behalf without delegating user permissions.

Question 2

Which identity governance capability ensures that toxic combinations of access rights are not granted to the same individual?

Accepted Answer

Separation of duties (SoD) policy enforcement

Answer

SoD policy enforcement detects and prevents scenarios where a single user holds conflicting permissions that together could enable fraud or bypass controls.

Question 3

A security architect is evaluating trust levels in a multi-cloud environment. What is the purpose of a Cloud Access Security Broker (CASB)?

Accepted Answer

Providing visibility, compliance, and threat protection for cloud service usage

Answer

A CASB sits between users and cloud services to enforce security policies, provide visibility into shadow IT, ensure compliance, and detect threats across SaaS, IaaS, and PaaS.

Question 4

During a security architecture review, a CSI discovers that service accounts share the same credentials. What is the PRIMARY risk this creates?

Accepted Answer

Inability to attribute actions to specific services, complicating breach investigation and containment

Answer

Shared credentials prevent attribution of individual service actions, make credential rotation difficult, and mean that a single compromised credential affects multiple services simultaneously.

Question 5

What is the security significance of certificate pinning in mobile application architecture?

Accepted Answer

It prevents man-in-the-middle attacks by binding the app to a specific certificate or public key

Answer

Certificate pinning embeds the expected server certificate or public key in the app, so even a rogue certificate from a trusted CA will be rejected, preventing interception.

(CSI) Certified System Integrator Practice Test

(CSI) Certified System Integrator Practice Test

CSI Security Architecture & IAM 3