Identity and Access Management Flashcards
7 cards from real CySA+ Test practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Identity and Access Management flashcards as text
Which IAM solution is specifically designed to manage, monitor, and control access to privileged accounts such as domain administrators and service accounts?
Answer: Privileged Access Management (PAM)
PAM solutions provide vaulting, session recording, just-in-time access, and fine-grained controls over privileged accounts, which are the highest-value targets for attackers.
An attacker obtains valid usernames and passwords from a data breach on one site and attempts to use those same credentials on a banking website. What type of attack is this?
Answer: Credential stuffing
Credential stuffing uses stolen username/password pairs from one breach to attempt access to other services, exploiting password reuse across multiple sites.
OAuth 2.0 is primarily used to provide which of the following capabilities?
Answer: Delegated authorization allowing third-party apps to access resources on behalf of a user
OAuth 2.0 is an authorization framework that enables third-party applications to obtain limited access to a user's resources without exposing their credentials.
Which authentication factor category does a fingerprint scanner represent?
Answer: Something you are
Biometric factors like fingerprints, retina scans, and facial recognition fall under 'something you are' — inherence factors tied to a user's physical characteristics.
An organization implements a policy that grants employees elevated privileges only for the specific window of time they need to perform a task, then automatically revokes access. What IAM concept does this describe?
Answer: Just-in-Time (JIT) access
Just-in-Time access provisions elevated privileges for a defined time window only when needed, then automatically revokes them, minimizing the exposure window for privileged accounts.
Which directory protocol is most commonly used by enterprises to centrally store and manage user identities, credentials, and group memberships?
Answer: LDAP
LDAP (Lightweight Directory Access Protocol) is the standard protocol for querying and modifying directory services such as Microsoft Active Directory where user identities and attributes are stored.
During a periodic access review, an analyst discovers a developer has access to the production financial database that they were granted six months ago for a one-time audit. This is an example of what IAM risk?
Answer: Privilege creep
Privilege creep occurs when users accumulate permissions over time beyond what their current role requires, often because old access is never revoked after temporary needs are met.