SSCP Access Control & Identity Management 5 — Questions and Answers
Question 1: Which of the following is the BEST description of identity proofing?
- Verifying that a user knows their password during login
- The process of confirming that a person is who they claim to be before issuing credentials (Correct answer)
- Checking whether a user's account is still active in the directory
- Validating that a digital certificate has not been revoked
Correct answer: The process of confirming that a person is who they claim to be before issuing credentials
Identity proofing is the initial verification process used to confirm a person's real-world identity before enrolling them in an identity system.
Question 2: What is the primary purpose of a Privileged Identity Management (PIM) solution?
- To replace passwords with biometric authentication for all users
- To monitor, control, and audit the use of privileged accounts (Correct answer)
- To enforce multi-factor authentication on standard user accounts
- To store encrypted credentials in a shared team vault
Correct answer: To monitor, control, and audit the use of privileged accounts
PIM solutions manage and monitor privileged accounts to reduce risk from misuse of administrative credentials.
Question 3: A user requests access to a sensitive system, and the system automatically routes the request to the user's manager for approval before granting access. This is part of which process?
- Access recertification
- Access request and approval workflow (Correct answer)
- Just-in-time provisioning
- Role engineering
Correct answer: Access request and approval workflow
Access request and approval workflows ensure that access grants are reviewed and authorized by appropriate personnel before being applied.
Question 4: Which attack involves using a previously captured authentication credential to gain unauthorized access at a later time?
- Pass-the-hash
- Credential stuffing
- Replay attack (Correct answer)
- Golden ticket attack
Correct answer: Replay attack
In a replay attack, an adversary captures and reuses a valid authentication message or token to impersonate a user.
Question 5: When implementing RBAC, which process involves defining and organizing job functions and their corresponding access permissions?
- Access recertification
- Role engineering (Correct answer)
- Identity federation
- Privilege escalation
Correct answer: Role engineering
Role engineering is the process of defining roles, determining what access each role requires, and mapping users to appropriate roles.
Question 6: Which concept ensures that digital identity attributes are consistent and accurate across all systems within an organization?
- Identity synchronization (Correct answer)
- Single Sign-On
- Access recertification
- Account federation
Correct answer: Identity synchronization
Identity synchronization keeps user attributes (name, email, department) consistent across directories and connected systems.
Question 7: A company performs a periodic review to ensure that all user access rights are still appropriate for current job roles. What is this process called?
- Penetration testing
- Access recertification (user access review) (Correct answer)
- Identity proofing
- Risk assessment
Correct answer: Access recertification (user access review)
Access recertification (also called a user access review) is a periodic audit where managers confirm that employee access rights remain appropriate.
SSCP Access Control & Identity Management 5
Which of the following is the BEST description of identity proofing?