SSCP Certification SSCP Identity and Access Management 2 — Questions and Answers
Question 1: What is the main security benefit of implementing Single Sign-On (SSO) in an enterprise environment?
- Increases the number of passwords users must remember
- Reduces attack surface by centralizing authentication (Correct answer)
- Eliminates the need for multi-factor authentication
- Stores all credentials in plaintext for efficiency
Correct answer: Reduces attack surface by centralizing authentication
SSO centralizes authentication to a single trusted identity provider, reducing the number of credential stores and attack vectors across the environment.
Question 2: Which of the following best describes a federated identity system?
- A single organization managing all user identities internally
- Multiple organizations sharing identity assertions across trust boundaries (Correct answer)
- A password manager used by all employees
- An intrusion detection system that monitors logins
Correct answer: Multiple organizations sharing identity assertions across trust boundaries
Federated identity allows separate organizations to trust and share identity information, enabling users to authenticate once and access resources across organizational boundaries.
Question 3: What does the term 'account harvesting' refer to in identity security?
- Collecting valid usernames for use in attacks (Correct answer)
- Backing up user account data
- Migrating accounts between systems
- Assigning roles to new users
Correct answer: Collecting valid usernames for use in attacks
Account harvesting is the technique attackers use to enumerate valid usernames from a system, which can then be targeted in brute-force or credential stuffing attacks.
Question 4: Which protocol is most commonly used for federated authentication across web applications and cloud services?
- LDAP
- RADIUS
- SAML (Correct answer)
- TACACS+
Correct answer: SAML
Security Assertion Markup Language (SAML) is the widely adopted XML-based standard for exchanging authentication and authorization data between identity providers and service providers.
Question 5: In IAM, what is 'role explosion'?
- A DDoS attack on an RBAC system
- An excessive proliferation of roles making management unmanageable (Correct answer)
- Automatic escalation of user privileges
- A misconfiguration in Active Directory
Correct answer: An excessive proliferation of roles making management unmanageable
Role explosion occurs when an RBAC implementation creates so many granular roles that management becomes complex, often leading to inconsistent permissions and audit failures.
Question 6: What is the purpose of an identity governance and administration (IGA) solution?
- Encrypt all network communications
- Automate identity lifecycle, access requests, and compliance reporting (Correct answer)
- Monitor endpoint devices for malware
- Manage firewall rule sets
Correct answer: Automate identity lifecycle, access requests, and compliance reporting
IGA solutions automate the full identity lifecycle — provisioning, access requests, certification, and audit reporting — to enforce policy and meet compliance requirements.
SSCP Certification SSCP Identity and Access Management 2
What is the main security benefit of implementing Single Sign-On (SSO) in an enterprise environment?