CySA+ Test Identity and Access Management

Question 1

Which IAM principle ensures that users are granted only the minimum permissions necessary to perform their job functions?

Accepted Answer

Least privilege

Answer

Separation of duties

Answer

Need to know

Answer

Role rotation

Question 2

A security analyst notices that a terminated employee's account is still active in Active Directory two weeks after their departure. Which IAM process failed?

Accepted Answer

De-provisioning (off-boarding)

Answer

Provisioning

Answer

Authentication

Answer

Role-based access review

Question 3

Which access control model assigns permissions based on an employee's job function or title within an organization?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 4

An organization wants to allow employees to log in to multiple internal applications using a single set of credentials. Which technology best supports this requirement?

Accepted Answer

Single Sign-On (SSO)

Answer

Multi-Factor Authentication (MFA)

Answer

Public Key Infrastructure (PKI)

Answer

Privileged Access Management (PAM)

Question 5

Which protocol is most commonly used to enable federated identity management between organizations and cloud service providers?

Accepted Answer

SAML 2.0

Answer

RADIUS

Answer

LDAP

Answer

TACACS+

Question 6

Which IAM concept requires that a single critical task be divided among multiple individuals so that no one person has complete control?

Accepted Answer

Separation of duties

Answer

Least privilege

Answer

Need to know

Answer

Mandatory vacation

Question 7

A CySA+ analyst is reviewing an IAM report and finds several accounts that have not been used in 90 days. What should be the FIRST action taken?

Accepted Answer

Disable the accounts pending review and notify account owners

Answer

Immediately delete all inactive accounts

Answer

Reset the passwords on all inactive accounts

Answer

Add the accounts to a high-privilege monitoring group