Industry Best Practices Flashcards

Which approach best reduces MFA fatigue (push bombing) attacks?

Answer: Use number matching or phishing-resistant authenticators and rate-limit push requests

Number matching and rate limiting stop users from blindly approving attacker-initiated prompts.

What is the purpose of periodic access certification (access reviews) campaigns?

Answer: To verify that users' current access is still appropriate and remove what is not

Access reviews let managers or app owners confirm or revoke entitlements, preventing privilege creep.

A user changes departments and keeps permissions from the old role. What is this risk called?

Answer: Privilege creep

Privilege creep occurs when access accumulates across role changes without removal of old entitlements.

Which practice best supports separation of duties in identity administration?

Answer: Using custom admin roles scoped to specific resources and tasks

Scoped admin roles divide responsibilities so no single person controls an entire sensitive process.

What is credential stuffing?

Answer: Using username/password pairs leaked from other breaches to try logins

Credential stuffing exploits password reuse by replaying breached credential pairs at scale.

Which control is most effective at mitigating password spraying attacks?

Answer: Enforcing MFA and blocking common passwords

MFA neutralizes guessed passwords, and banned-password lists remove the common values sprayers try.

Why should legacy authentication protocols such as basic auth for IMAP/POP be disabled?

Answer: They cannot enforce MFA, making them a common bypass path

Legacy protocols send passwords directly and cannot perform interactive MFA, so attackers target them.