ICC Security & Authentication 3 — Questions and Answers
Question 1: In IICS, which type of connection credential storage ensures that passwords are never stored in plain text within the platform?
- Environment variable injection
- Encrypted credential vault (Secure Parameters) (Correct answer)
- Flat-file credential store
- Base64-encoded connection strings
Correct answer: Encrypted credential vault (Secure Parameters)
IICS Secure Parameters store sensitive values in an encrypted vault so they are never exposed as plain text in connection definitions.
Question 2: What is the effect of assigning a user the 'Monitor' role in IICS without any additional roles?
- The user can start and stop jobs but cannot view logs
- The user can view job status and logs but cannot create or modify assets (Correct answer)
- The user has full read-write access to all assets
- The user can only access the API and not the UI
Correct answer: The user can view job status and logs but cannot create or modify assets
The Monitor role grants read-only visibility into job execution status and logs without permitting asset creation or modification.
Question 3: Which protocol does IICS use to encrypt data in transit between the Secure Agent and cloud services by default?
- FTP with PGP envelope
- TLS 1.2 or higher (Correct answer)
- IPSec tunnel mode
- SSH tunneling only
Correct answer: TLS 1.2 or higher
IICS mandates TLS 1.2 or higher for all data in transit between Secure Agents and the cloud control plane.
Question 4: An IICS administrator needs to allow a third-party application to invoke IICS REST APIs on behalf of users without storing their passwords. Which grant type should be used?
- Resource Owner Password Credentials
- Client Credentials
- Authorization Code with PKCE (Correct answer)
- Implicit grant
Correct answer: Authorization Code with PKCE
Authorization Code with PKCE is recommended for third-party applications acting on behalf of users without handling passwords.
Question 5: In IICS, where are audit logs for user login events and asset changes stored and accessible?
- Only in the Secure Agent local file system
- In the IICS Audit Log report under the Monitor tab (Correct answer)
- In an external SIEM that must be configured manually
- In the PostgreSQL metadata database of the Secure Agent
Correct answer: In the IICS Audit Log report under the Monitor tab
IICS records user and asset audit events in the platform's Audit Log report, accessible from the Monitor section of the UI.
Question 6: Which IICS setting controls the maximum number of failed login attempts before a user account is automatically locked?
- Session timeout threshold
- Password complexity policy
- Account lockout policy (Correct answer)
- MFA retry limit
Correct answer: Account lockout policy
The account lockout policy in IICS organization settings defines how many failed authentication attempts trigger an automatic account lock.
Question 7: A developer wants to test an IICS connection that uses OAuth 2.0 without exposing the refresh token in task logs. What should they do?
- Store the refresh token as a Secure Parameter and reference it in the connection (Correct answer)
- Embed the refresh token directly in the mapping expression
- Log the token to a masked output field for debugging
- Use a hardcoded string in the connection URL query parameter
Correct answer: Store the refresh token as a Secure Parameter and reference it in the connection
Storing the refresh token as a Secure Parameter prevents it from appearing in plain text in task logs or connection definitions.
ICC Security & Authentication 3
In IICS, which type of connection credential storage ensures that passwords are never stored in plain text within the platform?