SC-100 Identity & Access Management Architecture — Questions and Answers

Question 1: What is the primary goal of identity and access management (IAM)?

To block all external users.
To provide secure and controlled access to enterprise resources (Correct answer)
To reduce system performance.
To increase complexity for users.

Correct answer: To provide secure and controlled access to enterprise resources

The primary goal of Identity and Access Management (IAM) is to ensure that the right individuals have the right access to the right resources at the right time and for the right reasons. It provides secure and controlled access to enterprise resources by managing digital identities and enforcing access policies. This prevents unauthorized access while enabling legitimate users to perform their duties efficiently.

Question 2: What is role-based access control (RBAC)?

A method to track user behavior.
A system that blocks internet access.
Access control based on user roles and responsibilities (Correct answer)
A way to manage software updates.

Correct answer: Access control based on user roles and responsibilities

Role-Based Access Control (RBAC) is an access control mechanism that grants or restricts system access to users based on their defined roles and responsibilities within an organization. Instead of assigning permissions directly to individual users, permissions are assigned to roles, and users are then assigned to appropriate roles. This simplifies management, improves security, and ensures users only have access necessary for their job functions.

Question 3: Why is multi-factor authentication (MFA) important?

It simplifies the login process.
It allows access without passwords.
It strengthens security by combining multiple authentication methods (Correct answer)
It slows down authentication speed.

Correct answer: It strengthens security by combining multiple authentication methods

Multi-Factor Authentication (MFA) significantly strengthens security by requiring users to provide two or more distinct verification factors to gain access to a resource. By combining something the user knows (like a password), something the user has (like a phone or token), and/or something the user is (like a fingerprint), MFA makes it much harder for unauthorized individuals to compromise accounts, even if one factor is stolen.

Question 4: Which component stores user identities and credentials?

Firewall
Load balancer
Directory service (Correct answer)
Web server

Correct answer: Directory service

A directory service, such as Active Directory or Azure Active Directory, is a centralized repository that stores information about network resources, including user identities, credentials, and group memberships. It provides authentication and authorization services, allowing users to log in and access resources across the network. This centralizes identity management and ensures consistent access policies.

Question 5: What does 'least privilege' mean in IAM?

Giving users admin rights.
Granting minimal access to users to reduce risk (Correct answer)
Allowing full access to all employees.
Disabling access controls.

Correct answer: Granting minimal access to users to reduce risk

The principle of 'least privilege' dictates that users, programs, or processes should be granted only the minimum necessary permissions to perform their legitimate functions. This minimizes the potential damage if an account is compromised or misused, limiting an attacker's lateral movement and impact. It is a fundamental security best practice in Identity and Access Management (IAM).

Question 6: Which protocol is commonly used for single sign-on (SSO)?

SMTP
IMAP
SAML (Correct answer)
FTP

Correct answer: SAML

Security Assertion Markup Language (SAML) is an XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider. It is widely used to implement Single Sign-On (SSO), allowing users to authenticate once with an identity provider and then access multiple service providers without re-entering credentials. This streamlines user experience while maintaining security.

Question 7: What does identity federation allow?

Sharing passwords with third parties.
Multiple identities per user.
Access across systems using a single trusted identity (Correct answer)
Disable authentication entirely.

Correct answer: Access across systems using a single trusted identity

Identity federation allows users to use a single set of credentials to access multiple, independent systems or applications across different security domains. It establishes a trust relationship between identity providers and service providers, allowing the identity provider to authenticate users and assert their identity to the service provider. This simplifies user access and management, especially in hybrid or multi-cloud environments.

Question 8: Which IAM concept focuses on evaluating user risk continuously?

Static authentication.
Adaptive access control (Correct answer)
Credential caching.
Manual reviews only.

Correct answer: Adaptive access control

Adaptive access control continuously evaluates user risk based on various contextual factors, such as location, device, behavior, and time of access, before granting or denying access. Unlike static authentication, it dynamically adjusts access permissions in real-time based on the assessed risk level. This provides a more flexible and robust security posture, responding to evolving threats.

Question 9: Which tool helps manage user permissions across cloud environments?

VPN
Identity governance platform (Correct answer)
Proxy server
CDN

Correct answer: Identity governance platform

An identity governance platform helps organizations manage and audit user permissions, access rights, and compliance across various on-premises and cloud environments. It provides visibility into who has access to what, automates access reviews, and enforces policies to ensure least privilege and regulatory compliance. This is crucial for maintaining control over identities in complex hybrid cloud infrastructures.

SC-100 Identity & Access Management Architecture

What is the primary goal of identity and access management (IAM)?