Cyber Security Identity and Access Management 2 — Questions and Answers
Question 1: What does ABAC (Attribute-Based Access Control) use to make access decisions?
- Fixed roles assigned at account creation
- Attributes of the user, resource, and environment at the time of access (Correct answer)
- Group membership in Active Directory
- Physical badges and biometrics only
Correct answer: Attributes of the user, resource, and environment at the time of access
ABAC evaluates attributes such as user department, resource classification, and time of day to make dynamic access decisions.
Question 2: What is credential stuffing?
- Storing credentials in an unencrypted text file
- Using stolen username/password pairs from one breach to attempt login to other services (Correct answer)
- Brute-forcing passwords using a dictionary list
- Encoding passwords in Base64 before transmission
Correct answer: Using stolen username/password pairs from one breach to attempt login to other services
Credential stuffing automates login attempts using credentials leaked from one breach to compromise accounts on other services.
Question 3: What is the function of a directory service like Microsoft Active Directory?
- Host web applications for enterprise users
- Centrally manage user accounts, groups, and authentication policies (Correct answer)
- Encrypt inter-domain network traffic
- Monitor network traffic for intrusion detection
Correct answer: Centrally manage user accounts, groups, and authentication policies
Active Directory centrally manages user identities, group memberships, and security policies across a Windows domain.
Question 4: What does JIT (Just-In-Time) provisioning provide in privileged access management?
- Permanent admin access for all IT staff
- Temporary elevated access granted only when needed and automatically revoked after use (Correct answer)
- Automatic user account creation upon hire
- Real-time password rotation for service accounts
Correct answer: Temporary elevated access granted only when needed and automatically revoked after use
JIT provisioning grants elevated privileges only for the duration needed for a task, minimizing persistent privileged access.
Question 5: What is the risk of orphaned accounts in access management?
- They consume excessive storage in the identity store
- They represent access paths that may be exploited since no active owner monitors them (Correct answer)
- They generate excessive authentication log noise
- They prevent new users from being created
Correct answer: They represent access paths that may be exploited since no active owner monitors them
Orphaned accounts (accounts of former employees or decommissioned services) remain active and can be exploited by attackers.
Question 6: Which protocol is commonly used for federated authentication between web applications using XML assertions?
- OAuth 2.0
- SAML 2.0 (Correct answer)
- OpenID Connect
- RADIUS
Correct answer: SAML 2.0
SAML 2.0 (Security Assertion Markup Language) exchanges XML-based authentication assertions between identity providers and service providers.
Cyber Security Identity and Access Management 2
What does ABAC (Attribute-Based Access Control) use to make access decisions?