CyberVista Identity and Access Management Questions and Answers

Question 1

A financial services company is implementing a new access control policy. They require a dynamic model that can make access decisions based on a user's role, the sensitivity of the data they are trying to access, their current geographic location, and the time of day. Which of the following access control models would be MOST suitable for these requirements?

Accepted Answer

Attribute-Based Access Control (ABAC)

Answer

Attribute-Based Access Control (ABAC) is the most suitable model because it uses policies that evaluate multiple attributes of the user, resource, and environment to make real-time access decisions. This allows for the creation of complex, context-aware rules that can factor in variables like location and time, which is not possible with the other models. RBAC is based solely on user roles, while MAC and DAC are less flexible for this kind of dynamic environment.

Question 2

Which of the following BEST describes the primary function of Security Assertion Markup Language (SAML) in an Identity and Access Management framework?

Accepted Answer

To exchange authentication and authorization data between an identity provider (IdP) and a service provider (SP) to enable single sign-on (SSO).

Answer

SAML is an open standard specifically designed for exchanging authentication and authorization information between parties, most commonly an Identity Provider (IdP) and a Service Provider (SP). Its primary use case is to facilitate web-based, cross-domain single sign-on (SSO), allowing a user to log in once and gain access to multiple separate systems without re-entering credentials.

Question 3

A security administrator is configuring access for a new database administrator (DBA). Following the principle of least privilege, which approach should the administrator take?

Accepted Answer

Provide the DBA with administrative access only to the specific database servers they are responsible for managing.

Answer

The principle of least privilege dictates that users should only be granted the minimum level of access and permissions necessary to perform their job functions. Providing administrative access only to the specific database servers the DBA manages directly aligns with this principle, minimizing the potential attack surface if the account were to be compromised.

Question 4

In the context of Identity and Access Management, what is the key difference between authentication and authorization?

Accepted Answer

Authentication is the process of verifying a user's identity, while authorization is the process of granting or denying access to specific resources.

Answer

Authentication is the first step, where a system verifies that users are who they claim to be, typically through credentials like a password, a biometric scan, or a security token. Once a user is authenticated, authorization takes place to determine what specific resources, files, or actions they are permitted to access based on predefined policies.

Question 5

A company has a high turnover rate in its sales department. Which automated IAM process is most critical to implement to mitigate the security risk associated with departing employees?

Accepted Answer

User deprovisioning

Answer

User deprovisioning is the process of promptly revoking a user's access to all corporate systems and data when their employment is terminated. Automating this process is critical in a high-turnover environment to ensure that former employees cannot retain access, which would create a significant security vulnerability known as an 'orphaned account'.

CyberVista Test Practice Test

CyberVista Test Practice Test

CyberVista Identity and Access Management Questions and Answers