CASE CASE Identity & Access Management

Question 1

What does the principle of least privilege require?

Accepted Answer

Granting users only the minimum permissions necessary to perform their job duties

Answer

Least privilege limits access rights to the minimum required for a user's role, reducing the attack surface from over-permissioned accounts.

Question 2

What is Multi-Factor Authentication (MFA)?

Accepted Answer

Requiring two or more verification factors from different categories to authenticate

Answer

MFA requires credentials from two or more independent factor categories — knowledge, possession, and inherence — to verify identity.

Question 3

How does Role-Based Access Control (RBAC) manage permissions?

Accepted Answer

By assigning permissions to defined roles rather than to individual users

Answer

RBAC assigns permissions to predefined roles, and users gain access by being assigned to roles appropriate for their job function.

Question 4

What is federated identity in application security?

Accepted Answer

An identity management approach allowing authentication to span multiple trust domains

Answer

Federated identity enables a user to authenticate once in one domain and access resources across multiple organizations or systems without re-authenticating.

Question 5

What is the role of an Identity Provider (IdP)?

Accepted Answer

To authenticate users and assert their identity to relying service providers

Answer

An Identity Provider authenticates users and issues identity assertions such as tokens or claims that service providers trust for access decisions.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE CASE Identity & Access Management