ISAC Access Control and Authentication 4

Question 1

Which of the following is the BEST description of attribute-based access control (ABAC)?

Accepted Answer

Access decisions are made using multiple attributes of the user, resource, and environment

Answer

Access is granted based solely on the user's role within the organization

Answer

Access is determined by the data owner who sets permissions on each object

Answer

Access is controlled entirely by system-enforced security labels

Question 2

A company implements a policy requiring all privileged accounts to use a dedicated workstation with enhanced logging and session recording. This is a characteristic of:

Accepted Answer

Privileged Access Management (PAM)

Answer

Identity Governance and Administration (IGA)

Answer

Public Key Infrastructure (PKI)

Answer

Security Information and Event Management (SIEM)

Question 3

Which open standard protocol enables secure, token-based authorization for third-party applications without sharing user credentials?

Accepted Answer

OAuth 2.0

Answer

SAML 2.0

Answer

OpenID Connect 1.0

Answer

WS-Federation

Question 4

What is the purpose of an account lockout policy in an authentication system?

Accepted Answer

To disable accounts after a set number of failed login attempts, mitigating brute-force attacks

Answer

To encrypt stored passwords after a defined retention period

Answer

To automatically promote accounts to privileged status after inactivity

Answer

To enforce password complexity requirements across all user accounts

Question 5

A user's biometric fingerprint scan is compared against a stored template during login. This process is an example of:

Accepted Answer

Authentication using 'something you are'

Answer

Identification using 'something you are'

Answer

Authorization using 'something you have'

Answer

Accountability using 'something you know'

Question 6

Which term describes the process of reviewing user account permissions periodically to ensure they remain appropriate and remove excess access?

Accepted Answer

Access Certification (User Access Review)

Answer

Provisioning

Answer

Authentication Audit

Answer

Privilege Escalation Review

Question 7

In Public Key Infrastructure (PKI), what role does a Certificate Authority (CA) play in authentication?

Accepted Answer

It signs digital certificates to vouch for the binding between a public key and an identity

Answer

It generates one-time passwords for users during login

Answer

It stores encrypted private keys on behalf of users

Answer

It manages access control lists for network resources