CySA+ Test Identity and Access Management 2 — Questions and Answers
Question 1: Which IAM solution is specifically designed to manage, monitor, and control access to privileged accounts such as domain administrators and service accounts?
- Identity Governance and Administration (IGA)
- Privileged Access Management (PAM) (Correct answer)
- Identity Federation Service
- Directory Services (LDAP)
Correct answer: Privileged Access Management (PAM)
PAM solutions provide vaulting, session recording, just-in-time access, and fine-grained controls over privileged accounts, which are the highest-value targets for attackers.
Question 2: An attacker obtains valid usernames and passwords from a data breach on one site and attempts to use those same credentials on a banking website. What type of attack is this?
- Brute force attack
- Password spraying
- Credential stuffing (Correct answer)
- Dictionary attack
Correct answer: Credential stuffing
Credential stuffing uses stolen username/password pairs from one breach to attempt access to other services, exploiting password reuse across multiple sites.
Question 3: OAuth 2.0 is primarily used to provide which of the following capabilities?
- Mutual TLS authentication between servers
- Delegated authorization allowing third-party apps to access resources on behalf of a user (Correct answer)
- Password-based authentication for web applications
- Certificate-based identity verification
Correct answer: Delegated authorization allowing third-party apps to access resources on behalf of a user
OAuth 2.0 is an authorization framework that enables third-party applications to obtain limited access to a user's resources without exposing their credentials.
Question 4: Which authentication factor category does a fingerprint scanner represent?
- Something you know
- Something you have
- Something you are (Correct answer)
- Somewhere you are
Correct answer: Something you are
Biometric factors like fingerprints, retina scans, and facial recognition fall under 'something you are' — inherence factors tied to a user's physical characteristics.
Question 5: An organization implements a policy that grants employees elevated privileges only for the specific window of time they need to perform a task, then automatically revokes access. What IAM concept does this describe?
- Continuous monitoring
- Just-in-Time (JIT) access (Correct answer)
- Attribute-Based Access Control
- Temporal access delegation
Correct answer: Just-in-Time (JIT) access
Just-in-Time access provisions elevated privileges for a defined time window only when needed, then automatically revokes them, minimizing the exposure window for privileged accounts.
Question 6: Which directory protocol is most commonly used by enterprises to centrally store and manage user identities, credentials, and group memberships?
- RADIUS
- TACACS+
- LDAP (Correct answer)
- Kerberos
Correct answer: LDAP
LDAP (Lightweight Directory Access Protocol) is the standard protocol for querying and modifying directory services such as Microsoft Active Directory where user identities and attributes are stored.
Question 7: During a periodic access review, an analyst discovers a developer has access to the production financial database that they were granted six months ago for a one-time audit. This is an example of what IAM risk?
- Shadow IT
- Privilege creep (Correct answer)
- Insider threat escalation
- Toxic combination
Correct answer: Privilege creep
Privilege creep occurs when users accumulate permissions over time beyond what their current role requires, often because old access is never revoked after temporary needs are met.
CySA+ Test Identity and Access Management 2
Which IAM solution is specifically designed to manage, monitor, and control access to privileged accounts such as domain administrators and service accounts?