ISSAP - Information Systems Security Architecture Professional Identity and Access Management Questions and Answers — Questions and Answers
Question 1: A large, multinational corporation is designing an access control architecture for a new, highly dynamic environment. The system must support fine-grained access decisions based on a user's role, their geographic location, the time of day, and the data sensitivity of the resource being accessed. Traditional access control models are proving too static. Which of the following access control models would be MOST suitable for this architecture?
- Mandatory Access Control (MAC)
- Discretionary Access Control (DAC)
- Attribute-Based Access Control (ABAC) (Correct answer)
- Role-Based Access Control (RBAC)
Correct answer: Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is the most suitable model because it makes access decisions based on a combination of attributes of the user, resource, action, and environment. This allows for the creation of dynamic, context-aware policies that can handle the complexity described in the scenario (role, location, time, data sensitivity). RBAC is limited to user roles, while DAC is user-managed and MAC is based on security labels, neither of which provide the required flexibility.
Question 2: As a security architect for a financial services company, you are evaluating solutions to streamline user access across dozens of cloud-based (SaaS) and on-premises applications. The primary goals are to improve user experience with single sign-on (SSO), centralize identity management, and reduce the administrative burden of managing credentials in multiple systems. Which of the following architectural approaches BEST meets these requirements?
- Implementing a standalone Security Information and Event Management (SIEM) system.
- Deploying a host-based intrusion detection system (HIDS) on all application servers.
- Adopting an Identity as a Service (IDaaS) solution. (Correct answer)
- Establishing a manual, ticket-based provisioning and de-provisioning process.
Correct answer: Adopting an Identity as a Service (IDaaS) solution.
Identity as a Service (IDaaS) is a cloud-based subscription model that provides comprehensive identity and access management capabilities, including Single Sign-On (SSO), multi-factor authentication, and centralized user management. This directly addresses the company's need to streamline access across hybrid environments, improve user experience, and reduce administrative overhead. A SIEM is for monitoring, a HIDS is for host-level threat detection, and a manual process would increase, not decrease, administrative burden.
Question 3: An organization is building a partnership with several external companies, allowing their employees to access a shared collaboration portal. To avoid creating and managing separate user accounts for each partner employee, the security architect needs to design a solution where users can authenticate with their own corporate credentials. Which of the following technologies is fundamental to enabling this cross-domain trust and authentication?
- Kerberos
- Federated Identity Management (FIM) (Correct answer)
- RADIUS
- Lightweight Directory Access Protocol (LDAP)
Correct answer: Federated Identity Management (FIM)
Federated Identity Management (FIM) is the architectural pattern and set of standards (like SAML and OpenID Connect) that allows identities from one trust domain (the partner company) to be accepted by a service provider in another trust domain (the collaboration portal). This enables users to use their existing corporate credentials, establishing a trust relationship between the identity provider and the service provider. Kerberos and LDAP are typically used within a single organizational domain, and RADIUS is often used for network access control.
Question 4: A security architect is designing the identity lifecycle management process for a large enterprise. The architect must ensure that access rights are correctly assigned when an employee is hired, adjusted when they change roles, and revoked promptly when they leave. Which of the following frameworks is specifically designed to address these stages of the identity lifecycle?
- Zachman Framework
- TOGAF (The Open Group Architecture Framework)
- SABSA (Sherwood Applied Business Security Architecture)
- Joiner-Mover-Leaver (JML) (Correct answer)
Correct answer: Joiner-Mover-Leaver (JML)
The Joiner-Mover-Leaver (JML) framework is a core process within identity and access management that specifically outlines the procedures for onboarding (Joiner), role changes (Mover), and offboarding (Leaver). It ensures that user access privileges are managed dynamically and appropriately throughout their tenure with an organization, enforcing principles like least privilege. The other options are enterprise architecture frameworks, not specific IAM process models.
Question 5: When designing a federated identity solution using Security Assertion Markup Language (SAML), what is the primary role of the Identity Provider (IdP)?
- To host the application or resource the user wants to access.
- To consume identity assertions and grant or deny access to a resource.
- To authenticate the user and issue a security assertion containing identity information. (Correct answer)
- To provide a centralized repository for storing user passwords and attributes.
Correct answer: To authenticate the user and issue a security assertion containing identity information.
In a SAML federation, the Identity Provider (IdP) is the entity responsible for authenticating the user and, upon successful authentication, creating a security assertion (a SAML token) that contains information about the user's identity and attributes. This assertion is then sent to the Service Provider (SP), which consumes it to make an authorization decision. The SP hosts the resource. While an IdP uses a directory, its primary role in the federation is authentication and assertion issuance.
Question 6: Which of the following is a significant architectural challenge that can arise from the overuse or improper design of a Role-Based Access Control (RBAC) model in a large, complex organization?
- Attribute explosion
- Protocol decay
- Role explosion (Correct answer)
- Policy stagnation
Correct answer: Role explosion
Role explosion, or role proliferation, is a common problem in large-scale RBAC implementations. It occurs when an excessive number of granular roles are created to address specific access needs, making the model difficult to manage, audit, and scale. This complexity can undermine the initial simplicity that RBAC is intended to provide. Attribute explosion is a potential challenge for ABAC, not RBAC.
ISSAP - Information Systems Security Architecture Professional Identity and Access Management Questions and Answers
A large, multinational corporation is designing an access control architecture for a new, highly dynamic environment.
The system must support fine-grained access decisions based on a user's role, their geographic location, the time of day, and the data sensitivity of the resource being accessed.
Traditional access control models are proving too static.
Which of the following access control models would be MOST suitable for this architecture?