CyberVista Identity and Access Management Questions and Answers — Questions and Answers
Question 1: A financial services company is implementing a new access control policy. They require a dynamic model that can make access decisions based on a user's role, the sensitivity of the data they are trying to access, their current geographic location, and the time of day. Which of the following access control models would be MOST suitable for these requirements?
- Mandatory Access Control (MAC)
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC) (Correct answer)
Correct answer: Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is the most suitable model because it uses policies that evaluate multiple attributes of the user, resource, and environment to make real-time access decisions. This allows for the creation of complex, context-aware rules that can factor in variables like location and time, which is not possible with the other models. RBAC is based solely on user roles, while MAC and DAC are less flexible for this kind of dynamic environment.
Question 2: Which of the following BEST describes the primary function of Security Assertion Markup Language (SAML) in an Identity and Access Management framework?
- To provide a framework for creating and managing digital identities and their lifecycles within an organization.
- To exchange authentication and authorization data between an identity provider (IdP) and a service provider (SP) to enable single sign-on (SSO). (Correct answer)
- To enforce multi-factor authentication (MFA) by providing a standardized method for transmitting one-time passwords.
- To directly query user attributes and credentials stored in a directory service like LDAP or Active Directory.
Correct answer: To exchange authentication and authorization data between an identity provider (IdP) and a service provider (SP) to enable single sign-on (SSO).
SAML is an open standard specifically designed for exchanging authentication and authorization information between parties, most commonly an Identity Provider (IdP) and a Service Provider (SP). Its primary use case is to facilitate web-based, cross-domain single sign-on (SSO), allowing a user to log in once and gain access to multiple separate systems without re-entering credentials.
Question 3: A security administrator is configuring access for a new database administrator (DBA). Following the principle of least privilege, which approach should the administrator take?
- Grant the DBA full administrative rights to all servers on the network to ensure they can perform any necessary task.
- Assign the DBA to a standard user group and have them request elevated privileges for each specific task.
- Provide the DBA with administrative access only to the specific database servers they are responsible for managing. (Correct answer)
- Clone the permissions of the previous DBA who had broad access to multiple systems.
Correct answer: Provide the DBA with administrative access only to the specific database servers they are responsible for managing.
The principle of least privilege dictates that users should only be granted the minimum level of access and permissions necessary to perform their job functions. Providing administrative access only to the specific database servers the DBA manages directly aligns with this principle, minimizing the potential attack surface if the account were to be compromised.
Question 4: In the context of Identity and Access Management, what is the key difference between authentication and authorization?
- Authentication is the process of logging user actions, while authorization is the process of reviewing those logs.
- Authentication determines if a user is an administrator, while authorization determines if they are a standard user.
- Authentication is the process of verifying a user's identity, while authorization is the process of granting or denying access to specific resources. (Correct answer)
- Authentication involves managing the user lifecycle, while authorization is focused on password policies.
Correct answer: Authentication is the process of verifying a user's identity, while authorization is the process of granting or denying access to specific resources.
Authentication is the first step, where a system verifies that users are who they claim to be, typically through credentials like a password, a biometric scan, or a security token. Once a user is authenticated, authorization takes place to determine what specific resources, files, or actions they are permitted to access based on predefined policies.
Question 5: A company has a high turnover rate in its sales department. Which automated IAM process is most critical to implement to mitigate the security risk associated with departing employees?
- User provisioning
- Multi-factor authentication (MFA) enrollment
- Access certification campaigns
- User deprovisioning (Correct answer)
Correct answer: User deprovisioning
User deprovisioning is the process of promptly revoking a user's access to all corporate systems and data when their employment is terminated. Automating this process is critical in a high-turnover environment to ensure that former employees cannot retain access, which would create a significant security vulnerability known as an 'orphaned account'.
Question 6: A company wants to allow its employees to use their corporate credentials to log in to a third-party SaaS application for expense reporting. This is an example of which IAM concept?
- Privileged Access Management (PAM)
- Identity Federation (Correct answer)
- Role-Based Access Control (RBAC)
- Identity Governance and Administration (IGA)
Correct answer: Identity Federation
Identity Federation allows users from one domain (the company's corporate network, or Identity Provider) to securely access resources in another domain (the third-party SaaS app, or Service Provider) without needing a separate set of credentials. This establishes a trust relationship between the two entities, enabling single sign-on capabilities.
CyberVista Identity and Access Management Questions and Answers
A financial services company is implementing a new access control policy.
They require a dynamic model that can make access decisions based on a user's role, the sensitivity of the data they are trying to access, their current geographic location, and the time of day.
Which of the following access control models would be MOST suitable for these requirements?