Identity and Access Management — CISSP practice questions

Which outcome is the PRIMARY reason an organisation deploys an enterprise credential management system rather than letting each application handle its own secrets?

1. It removes the need to authenticate users at individual applications
2. It guarantees that every application will support the same authentication protocol
3. It centralises issuance, rotation and revocation of credentials under policy
4. It eliminates password reuse by forcing every user to memorise unique phrases

Answer: C — It centralises issuance, rotation and revocation of credentials under policy

C) Correct — the value is a single governed lifecycle for secrets so that revocation and rotation actually happen everywhere. A) confuses credential management with single sign-on, which is a different capability. B) overstates it; the system stores and issues credentials but cannot force legacy applications to change protocols. D) is a half-right answer — reuse drops, but because secrets are vaulted rather than memorised.

An access model assigns permissions to job functions such as claims adjuster and underwriter, and users inherit them by assignment. Which statement about groups and roles here is MOST accurate?

1. A role reflects a job function with a permission set; a group collects accounts
2. Groups and roles are interchangeable terms for the same directory construct
3. A role is a collection of accounts; a group defines the permissions those accounts hold
4. Roles apply only to privileged users, while groups apply only to standard users

Answer: A — A role reflects a job function with a permission set; a group collects accounts

A) Correct — roles are engineered around business functions and carry an authoritative permission set, whereas groups are membership containers that may or may not map to a function. B) is a widespread misconception encouraged by directory products that implement roles as groups. C) is a direction reversal of the two definitions. D) invents a privilege boundary that neither construct implies.

A SaaS partner will accept assertions from the company's identity provider, and accounts should appear at the partner only when someone first signs in. Which capability is being described?

1. Password synchronisation across the two directories
2. Just-in-time provisioning driven by the federation assertion
3. Bulk directory replication on a nightly schedule
4. Discretionary access control delegated to the partner

Answer: B — Just-in-time provisioning driven by the federation assertion

B) Correct — JIT provisioning creates or updates the account at the relying party from attributes carried in the assertion at first login, avoiding a pre-populated user store. A) is a different integration pattern that copies secrets rather than creating accounts on demand, and it defeats federation's main benefit. C) describes scheduled synchronisation, which pre-creates accounts and therefore is not just-in-time. D) names an authorisation model, not a provisioning mechanism.

A bank steps up to additional verification when a login shows an unfamiliar device and an improbable travel pattern, and otherwise permits a silent sign-in. Which benefit BEST justifies this design to management?

1. It removes the need for any second factor on trusted devices permanently
2. It ensures that no fraudulent authentication can succeed on a known device
3. It shifts liability for fraudulent transactions onto the customer's device vendor
4. It applies stronger verification in proportion to assessed risk

Answer: D — It applies stronger verification in proportion to assessed risk

D) Correct — risk-based authentication is a proportionality argument: friction is spent where the assessed risk warrants it, which is the management-level justification. A) overstates the outcome; policy can still require a factor and permanent exemption is not the design. B) claims elimination of risk, which no authentication control delivers. C) is a legal fiction; risk decisions do not transfer liability to a hardware vendor.

A firewall permits a partner's traffic only between 08:00 and 18:00 on weekdays, regardless of which partner user is involved. This is BEST described as:

1. Rule-based access control applying uniformly to all subjects
2. Discretionary access control exercised by the firewall owner
3. Attribute-based access control combining subject and resource attributes
4. Role-based access control mapped to the partner organisation's role

Answer: A — Rule-based access control applying uniformly to all subjects

A) Correct — a global condition applied identically to every subject is the hallmark of rule-based control, as in classic firewall rule sets. B) tempts because an administrator wrote the rule, but discretionary control means the resource owner grants per-subject access. C) is close, since time is a condition, yet no subject or resource attributes participate in the decision. D) is wrong because the rule ignores who the user is entirely.

Which BEST describes role-based access control?

1. Permissions granted individually to each user account
2. Public read access granted by default to all objects
3. Access decided by security labels the system enforces
4. Access granted at the discretion of the object owner
5. Permissions attached to roles, and users to roles

Answer: E — Permissions attached to roles, and users to roles

E is correct: permissions are bound to job functions and users inherit them through role membership, which simplifies provisioning, makes review tractable, and lets conflicting roles be separated. A is the unscalable per-user model RBAC replaces. B is a default that violates least privilege. C is mandatory access control, enforced by system labels rather than by role. D is discretionary access control, where owners grant rights directly. Attribute-based control extends this further using contextual attributes.

A federated relying party continues to honour a user's session for four hours after the identity provider disables the account. The MOST appropriate corrective action is to:

1. Require the user to close the browser at the end of each working day
2. Increase the identity provider's password rotation frequency
3. Shorten relying-party sessions and implement revocation signalling
4. Move the relying party from federation to locally managed accounts

Answer: C — Shorten relying-party sessions and implement revocation signalling

C) Correct — the gap is between provider-side revocation and relying-party session validity, closed by shorter sessions plus a signalling mechanism the relying party acts upon. A) depends on user behaviour and offers no assurance. B) addresses credential ageing, which has nothing to do with an already-issued session. D) is a direction reversal that trades one integration problem for a far worse deprovisioning problem across many local stores.

How should users authenticate across multiple cloud applications without separate credentials?

1. Reuse of a single password across every cloud application
2. A shared kiosk account used by all staff for cloud access
3. Distribution of each application password by email to users
4. Federated single sign-on using SAML, OAuth, or OpenID Connect
5. Removal of authentication for internally trusted applications

Answer: D — Federated single sign-on using SAML, OAuth, or OpenID Connect

D is correct: an identity provider authenticates once and issues a signed assertion or token to each relying application, so no credential is stored per service and policy including multi-factor authentication is enforced centrally. A is the trap that looks like single sign-on but is credential reuse, so one breach compromises everything. B destroys individual accountability. C transmits secrets over an unprotected channel. E removes the control entirely. SAML suits enterprise web SSO; OAuth and OpenID Connect suit modern applications and APIs.

RADIUS encrypts:

1. Only the shared-secret-protected password attribute in access-request packets
2. The entire packet payload, including username, attributes, and accounting data
3. Nothing at all — every RADIUS attribute traverses the network in clear text
4. Only messages sent from the authentication server back to the authenticator

Answer: A — Only the shared-secret-protected password attribute in access-request packets

A) Correct: RADIUS obscures only the User-Password attribute using the shared secret; all other attributes travel in clear text. B) That is TACACS+, which encrypts the full payload — the classic reversal trap. C) The password attribute is protected, so nothing is not accurate. D) RADIUS protection is attribute-scoped, not directional.

Staff currently use a password plus a one-time code delivered by SMS. Attackers are relaying codes through convincing look-alike login pages. Which change MOST directly defeats that attack?

1. Increase minimum password length and enforce quarterly rotation
2. Move the one-time code delivery from SMS to a push notification in an app
3. Deploy FIDO2 security keys whose assertions are bound to the site origin
4. Shorten the one-time code validity window from thirty to sixty seconds

Answer: C — Deploy FIDO2 security keys whose assertions are bound to the site origin

C) Correct — origin binding means a credential presented to a look-alike domain will not verify, which is what makes FIDO2 phishing-resistant rather than merely multi-factor. A) tempts because password hygiene is standard advice, but a relayed session defeats any password. B) is a real improvement against SIM swap yet push prompts are still relayable and invite fatigue attacks. D) reverses the direction — sixty seconds is longer than thirty, and real-time relay beats any practical window.

What are common Kerberos attacks?

Pass-the-ticket, Golden Ticket (forge TGT), Silver Ticket (forge service ticket), Kerberoasting (extract service account hashes for offline crack). Mitigations: protect KRBTGT key, monitoring, rotate keys.

What is standing privilege, and what replaces it in a just-in-time access model?

Standing privilege is elevated entitlement a principal holds continuously whether or not it is being used, so a compromised credential is immediately a privileged compromise. Just-in-time access replaces it with zero standing privilege: the account normally holds no elevated rights, and privilege is granted on approved request for a bounded window and revoked automatically at expiry, with the session brokered, recorded and tied to a ticket. The residual risk is the approval workflow itself, which must not be self-approvable and must have an audited break-glass path for emergencies.

What is biometric FAR vs. FRR vs. CER?

FAR: False Accept Rate (unauthorized accepted). FRR: False Reject Rate (legit rejected). CER: Crossover Error Rate (FAR=FRR). Lower CER = better biometric.

In a policy-based access control architecture, what do the PEP, PDP, PIP and PAP each do?

The policy enforcement point intercepts the request and enforces the outcome. The policy decision point evaluates the applicable policy and returns permit or deny. The policy information point supplies the attributes the decision needs — identity, device posture, sensitivity, time, location. The policy administration point is where policies are authored and managed. Separating enforcement from decision is what allows one consistent policy to be applied across many enforcement points, and is central to zero trust designs.