SE Identity and Access Management 2 — Questions and Answers
Question 1: Which federation protocol is most commonly used for SSO between web applications using XML-based assertions?
- OAuth 2.0
- OpenID Connect
- SAML 2.0 (Correct answer)
- Kerberos
Correct answer: SAML 2.0
SAML 2.0 uses XML-based security assertions to pass authentication and authorization data between identity providers and service providers.
Question 2: What is the difference between authentication and authorization?
- They are the same concept
- Authentication verifies identity; authorization determines what the identity is permitted to do (Correct answer)
- Authorization verifies identity; authentication grants access
- Authentication encrypts data; authorization decrypts it
Correct answer: Authentication verifies identity; authorization determines what the identity is permitted to do
Authentication answers 'who are you?', while authorization answers 'what are you allowed to do?' — they are distinct and sequential processes.
Question 3: Which Kerberos component issues Ticket Granting Tickets (TGTs) after initial user authentication?
- Service Principal
- Key Distribution Center (KDC) / Authentication Server (AS) (Correct answer)
- Ticket Granting Server (TGS)
- Service Ticket
Correct answer: Key Distribution Center (KDC) / Authentication Server (AS)
The Authentication Server (AS) within the KDC validates the user's credentials and issues a TGT that the user presents to get service tickets.
Question 4: A security engineer reviews access logs and finds a service account with domain admin rights that hasn't logged in for 180 days. What is the recommended action?
- Leave it; service accounts need broad rights
- Immediately disable and review the account's necessity and permissions (Correct answer)
- Reset the password only
- Move it to a different OU
Correct answer: Immediately disable and review the account's necessity and permissions
Dormant privileged accounts are a major attack surface; they should be disabled and reviewed for least-privilege compliance.
Question 5: Which access control model uses security labels and clearance levels to make access decisions, typically in government systems?
- RBAC
- DAC
- Mandatory Access Control (MAC) (Correct answer)
- ABAC
Correct answer: Mandatory Access Control (MAC)
MAC enforces access based on sensitivity labels (e.g., Top Secret, Secret) assigned to both subjects and objects by a central authority.
Question 6: What is the purpose of a Privileged Access Workstation (PAW)?
- Enable remote desktop for all users
- Provide a hardened, dedicated workstation for performing privileged administrative tasks (Correct answer)
- Replace VPN for remote access
- Automate patch management
Correct answer: Provide a hardened, dedicated workstation for performing privileged administrative tasks
A PAW is a dedicated, isolated workstation used exclusively for administrative tasks to reduce the risk of credential theft from malware on regular workstations.
SE Identity and Access Management 2
Which federation protocol is most commonly used for SSO between web applications using XML-based assertions?