OKTA Industry Best Practices 2

Question 1

According to NIST SP 800-63B guidance, which password policy practice is recommended?

Accepted Answer

Screen new passwords against lists of known compromised passwords

Answer

NIST 800-63B recommends checking passwords against breached-password lists rather than arbitrary periodic rotation or composition rules.

Question 2

Which principle states that users should receive only the access required to perform their job functions?

Accepted Answer

Least privilege

Answer

Least privilege limits access to the minimum required, reducing the blast radius of compromised accounts.

Question 3

An organization wants to ensure that terminated employees lose access to all SaaS apps immediately. Which practice best achieves this?

Accepted Answer

Automated deprovisioning driven by the HR system as the source of truth

Answer

HR-driven lifecycle automation deactivates the user in the identity provider and pushes deprovisioning to connected apps immediately.

Question 4

Which MFA factor type is considered phishing-resistant?

Accepted Answer

FIDO2/WebAuthn security key

Answer

FIDO2/WebAuthn binds the credential to the origin, so it cannot be replayed on a phishing site.

Question 5

What is the core idea behind a Zero Trust security model?

Accepted Answer

Never trust, always verify every access request regardless of network location

Answer

Zero Trust treats every request as untrusted and evaluates identity, device, and context each time.

OKTA - OKTA Certified Professional Practice Test