CSS CSS Identity & Access Management 2 — Questions and Answers
Question 1: Which IAM concept involves automatically removing access rights when they are no longer needed?
- Access certification and deprovisioning (Correct answer)
- User self-service enrollment
- Role explosion
- Credential harvesting
Correct answer: Access certification and deprovisioning
Regular access reviews (certifications) and automated deprovisioning ensure that users who change roles or leave the organization do not retain unnecessary access.
Question 2: What is the difference between authentication and authorization in IAM?
- Authentication verifies identity; authorization determines what an authenticated identity is permitted to do (Correct answer)
- Authorization verifies identity; authentication assigns permissions
- They are the same process
- Authentication assigns roles; authorization validates passwords
Correct answer: Authentication verifies identity; authorization determines what an authenticated identity is permitted to do
Authentication confirms who you are, while authorization determines what resources and actions you are permitted to access once your identity is confirmed.
Question 3: What is a federated identity in the context of IAM?
- An identity that is trusted and shared across multiple organizations or systems using a common standard (Correct answer)
- An identity that requires manual admin approval
- A local account synchronized to Active Directory only
- A temporary guest account with limited access
Correct answer: An identity that is trusted and shared across multiple organizations or systems using a common standard
Federated identity allows users to authenticate with one organization's identity provider and access resources at a partner organization without creating separate accounts.
Question 4: Which attack targets authentication systems by using previously captured valid authentication tokens?
- Pass-the-ticket / pass-the-hash attack (Correct answer)
- Phishing attack
- Password spraying
- SQL injection
Correct answer: Pass-the-ticket / pass-the-hash attack
Pass-the-hash and pass-the-ticket attacks use stolen authentication tokens to authenticate as a victim without knowing the actual password.
Question 5: What is the security purpose of just-in-time (JIT) privileged access?
- Grants elevated privileges only for the duration needed, then automatically revokes them (Correct answer)
- Provides persistent admin access to all systems
- Requires manual approval for every login attempt
- Replaces the need for multi-factor authentication
Correct answer: Grants elevated privileges only for the duration needed, then automatically revokes them
JIT access reduces the standing privilege attack surface by provisioning elevated rights only when requested and revoking them immediately after the task is complete.
Question 6: Which protocol is widely used for enterprise federated authentication and SSO?
- SAML (Security Assertion Markup Language) (Correct answer)
- FTP
- Kerberos only
- RADIUS only
Correct answer: SAML (Security Assertion Markup Language)
SAML is an XML-based open standard for exchanging authentication and authorization data between identity providers and service providers.
CSS CSS Identity & Access Management 2
Which IAM concept involves automatically removing access rights when they are no longer needed?