Industry Best Practices Flashcards

According to NIST SP 800-63B guidance, which password policy practice is recommended?

Answer: Screen new passwords against lists of known compromised passwords

NIST 800-63B recommends checking passwords against breached-password lists rather than arbitrary periodic rotation or composition rules.

Which principle states that users should receive only the access required to perform their job functions?

Answer: Least privilege

Least privilege limits access to the minimum required, reducing the blast radius of compromised accounts.

An organization wants to ensure that terminated employees lose access to all SaaS apps immediately. Which practice best achieves this?

Answer: Automated deprovisioning driven by the HR system as the source of truth

HR-driven lifecycle automation deactivates the user in the identity provider and pushes deprovisioning to connected apps immediately.

Which MFA factor type is considered phishing-resistant?

Answer: FIDO2/WebAuthn security key

FIDO2/WebAuthn binds the credential to the origin, so it cannot be replayed on a phishing site.

What is the core idea behind a Zero Trust security model?

Answer: Never trust, always verify every access request regardless of network location

Zero Trust treats every request as untrusted and evaluates identity, device, and context each time.

Why is it a best practice to maintain at least two break-glass super administrator accounts in an identity platform?

Answer: To preserve emergency access if the primary admin or federation path fails

Break-glass accounts provide recovery access during outages or lockouts and should be tightly secured and monitored.

Which practice best reduces the risk of standing privileged access?

Answer: Just-in-time, time-bound elevation of admin rights

Just-in-time access grants elevated privileges only when needed and revokes them automatically after a set period.