SE Identity and Access Management 1 — Questions and Answers
Question 1: Which access control model grants permissions based on a user's role within an organization?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC assigns permissions to roles rather than individuals, simplifying access management based on job function.
Question 2: What is the principle of least privilege?
- Users receive all permissions by default
- Users should have only the minimum access required to perform their job (Correct answer)
- Admins should not require passwords
- All data is publicly readable
Correct answer: Users should have only the minimum access required to perform their job
Least privilege limits user and process access to only what is necessary, reducing the attack surface if credentials are compromised.
Question 3: Which authentication factor category does a hardware security key (e.g., YubiKey) belong to?
- Something you know
- Something you have (Correct answer)
- Something you are
- Somewhere you are
Correct answer: Something you have
A hardware security key is a physical device the user possesses, making it a 'something you have' authentication factor.
Question 4: What is the primary security purpose of multi-factor authentication (MFA)?
- Speed up login
- Eliminate the need for passwords
- Require attackers to compromise multiple independent factors to gain access (Correct answer)
- Encrypt user sessions
Correct answer: Require attackers to compromise multiple independent factors to gain access
MFA ensures that stealing a single factor (e.g., a password) is insufficient for access, requiring additional proof of identity.
Question 5: Which protocol is commonly used to centralize authentication and authorization for network devices and VPNs?
- LDAP
- RADIUS (Correct answer)
- SAML
- OAuth 2.0
Correct answer: RADIUS
RADIUS (Remote Authentication Dial-In User Service) centralizes network access authentication and is widely used for VPNs and 802.1X.
Question 6: What is privilege creep, and why is it a security concern?
- A bug that crashes privilege management systems
- The gradual accumulation of excessive access rights over time, beyond what a role requires (Correct answer)
- A brute-force attack on privileged accounts
- Unauthorized privilege escalation via malware
Correct answer: The gradual accumulation of excessive access rights over time, beyond what a role requires
Privilege creep occurs when users accumulate permissions over time through role changes without removal of old rights, violating least privilege.
SE Identity and Access Management 1
Which access control model grants permissions based on a user's role within an organization?