CyberVista Identity and Access Management Flashcards

A financial services company is implementing a new access control policy. They require a dynamic model that can make access decisions based on a user's role, the sensitivity of the data they are trying to access, their current geographic location, and the time of day. Which of the following access control models would be MOST suitable for these requirements?

Answer: Attribute-Based Access Control (ABAC)

Attribute-Based Access Control (ABAC) is the most suitable model because it uses policies that evaluate multiple attributes of the user, resource, and environment to make real-time access decisions. This allows for the creation of complex, context-aware rules that can factor in variables like location and time, which is not possible with the other models. RBAC is based solely on user roles, while MAC and DAC are less flexible for this kind of dynamic environment.

Which of the following BEST describes the primary function of Security Assertion Markup Language (SAML) in an Identity and Access Management framework?

Answer: To exchange authentication and authorization data between an identity provider (IdP) and a service provider (SP) to enable single sign-on (SSO).

SAML is an open standard specifically designed for exchanging authentication and authorization information between parties, most commonly an Identity Provider (IdP) and a Service Provider (SP). Its primary use case is to facilitate web-based, cross-domain single sign-on (SSO), allowing a user to log in once and gain access to multiple separate systems without re-entering credentials.

A security administrator is configuring access for a new database administrator (DBA). Following the principle of least privilege, which approach should the administrator take?

Answer: Provide the DBA with administrative access only to the specific database servers they are responsible for managing.

The principle of least privilege dictates that users should only be granted the minimum level of access and permissions necessary to perform their job functions. Providing administrative access only to the specific database servers the DBA manages directly aligns with this principle, minimizing the potential attack surface if the account were to be compromised.

In the context of Identity and Access Management, what is the key difference between authentication and authorization?

Answer: Authentication is the process of verifying a user's identity, while authorization is the process of granting or denying access to specific resources.

Authentication is the first step, where a system verifies that users are who they claim to be, typically through credentials like a password, a biometric scan, or a security token. Once a user is authenticated, authorization takes place to determine what specific resources, files, or actions they are permitted to access based on predefined policies.

A company has a high turnover rate in its sales department. Which automated IAM process is most critical to implement to mitigate the security risk associated with departing employees?

Answer: User deprovisioning

User deprovisioning is the process of promptly revoking a user's access to all corporate systems and data when their employment is terminated. Automating this process is critical in a high-turnover environment to ensure that former employees cannot retain access, which would create a significant security vulnerability known as an 'orphaned account'.

A company wants to allow its employees to use their corporate credentials to log in to a third-party SaaS application for expense reporting. This is an example of which IAM concept?

Answer: Identity Federation

Identity Federation allows users from one domain (the company's corporate network, or Identity Provider) to securely access resources in another domain (the third-party SaaS app, or Service Provider) without needing a separate set of credentials. This establishes a trust relationship between the two entities, enabling single sign-on capabilities.