Cyber Security Identity and Access Management 3

Question 1

What is a service account in the context of IAM?

Accepted Answer

A non-human account used by applications or services to authenticate and access resources

Answer

Service accounts are dedicated identities for applications, scripts, or services that need to access systems or APIs.

Question 2

What does the principle of separation of duties prevent in access management?

Accepted Answer

A single individual from having enough access to commit and conceal fraud

Answer

Separation of duties requires multiple people to complete sensitive tasks, preventing any one person from both initiating and approving a transaction.

Question 3

What is OAuth 2.0 primarily designed for?

Accepted Answer

Authorizing third-party applications to access resources on behalf of a user

Answer

OAuth 2.0 is an authorization framework enabling limited access to user resources without exposing credentials.

Question 4

What is the purpose of a hardware security key (e.g., YubiKey) as an MFA factor?

Accepted Answer

Provide phishing-resistant authentication using a physical cryptographic device

Answer

Hardware security keys use public key cryptography bound to the specific website, making them resistant to phishing attacks.

Question 5

What is an access review in identity governance?

Accepted Answer

A periodic process where managers verify that users have appropriate access rights

Answer

Access reviews require managers or data owners to certify that users' current permissions remain appropriate for their roles.

Cyber Security Practice Test

Cyber Security Practice Test

Cyber Security Identity and Access Management 3