Industry Best Practices Flashcards

What is the best practice for where identity system logs should be sent for long-term monitoring and correlation?

Answer: Streamed to a SIEM for centralized analysis and alerting

Forwarding logs to a SIEM enables correlation with other sources, retention, and automated alerting.

Which adaptive access signal is commonly used to step up authentication requirements?

Answer: A login from a new device or unusual location

Risk-based policies evaluate context such as new device, geolocation, or IP reputation to require stronger verification.

Which statement best describes the role of device trust in access policies?

Answer: Only managed or compliant devices may access sensitive applications

Device trust adds a device-posture check so sensitive apps are reached only from managed, compliant endpoints.

What is the recommended way to store API tokens used for integrations with an identity platform?

Answer: In a secrets manager with restricted access and periodic rotation

Secrets managers protect tokens with access controls, auditing, and rotation, avoiding exposure in code repositories.

When designing self-service password reset, which practice is most secure?

Answer: Require a strong verified factor such as an authenticator app before reset

Requiring a strong factor prevents attackers from abusing recovery as a weaker path into the account.

Which approach is a best practice for testing changes to authentication policies before production rollout?

Answer: Test in a preview/sandbox tenant or with a pilot group first

Sandbox tenants and pilot groups reveal misconfigurations before they cause widespread lockouts.

Why is centralizing authentication through a single identity provider with SSO considered a best practice?

Answer: It enables consistent policy enforcement, visibility, and faster deprovisioning

A central IdP applies uniform security policies, provides unified logging, and revokes access everywhere at once.