Identity & Access Management test (Intermediate)

Sample questions

5 sample questions from the Identity & Access Management test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. Which MFA factor is considered the strongest and most phishing-resistant according to the study notes?

   1. FIDO2/WebAuthn passkeys and hardware keys
   2. Push notifications
   3. SMS/voice OTP
   4. TOTP apps

   Answer: A. FIDO2/WebAuthn passkeys and hardware keys

   According to the study notes, FIDO2/WebAuthn passkeys and hardware keys are the strongest MFA factor because they are phishing-resistant and origin-bound. SMS/voice OTP is the weakest due to vulnerabilities like SIM swapping and interception. TOTP apps are stronger than SMS but still vulnerable to MFA fatigue. Push notifications are also weaker than FIDO2/WebAuthn because of potential vulnerabilities.

2. Which statement best describes the scalability and management advantages of role-based access control (RBAC) compared to attribute-based access control (ABAC) in large organizations with complex policies?

   1. Role-based access control (RBAC) is more scalable and easier to manage than attribute-based access control (ABAC) in large organizations with many users and complex policies.
   2. RBAC and ABAC are equally effective in all scenarios and require no preference.
   3. Attribute-based access control (ABAC) is better for organizations with few users and simple policies due to its flexibility.
   4. ABAC is more scalable and easier to manage than RBAC in large organizations with many users and complex policies.

   Answer: A. Role-based access control (RBAC) is more scalable and easier to manage than attribute-based access control (ABAC) in large organizations with many users and complex policies.

   RBAC is more scalable and easier to manage than ABAC in large organizations with many users and complex policies because it assigns permissions to roles rather than individual attributes, reducing administrative overhead. ABAC, while more flexible, is harder to audit and manage due to its reliance on multiple attributes.

3. Which of the following best describes how LDAP directory replication latency can be minimized in a multi-server environment?

   1. Replication latency is only a concern for cloud-based directory services.
   2. Directory replication latency can be ignored in most enterprise environments.
   3. LDAP directory replication latency is typically minimized by using multi-master replication with conflict resolution mechanisms.
   4. LDAP directory replication latency is unaffected by network bandwidth or topology.

   Answer: C. LDAP directory replication latency is typically minimized by using multi-master replication with conflict resolution mechanisms.

   Multi-master replication with conflict resolution mechanisms ensures that updates are synchronized across all servers, minimizing latency. Other options are either incorrect or not directly related to reducing replication latency in LDAP directories.

4. What will happen to a user's account in a cloud directory if just-in-time (JIT) provisioning is used and the user leaves the organization?

   1. The user's account will be created in the cloud directory, but not deprovisioned when they leave the organization.
   2. The user's account will not be created unless manually provisioned by an administrator.
   3. The user's account will be deprovisioned immediately after the first login.
   4. The user's account will be created and deprovisioned automatically when they leave the organization.

   Answer: A. The user's account will be created in the cloud directory, but not deprovisioned when they leave the organization.

   Just-in-time (JIT) provisioning creates user accounts in the cloud directory when a user first logs in via SSO, but does not automatically deprovision the account when the user leaves the organization. This is a known limitation of JIT provisioning, which requires manual or additional automated processes for offboarding.

5. A software engineer discovers that a user has been granted access to a database they no longer need. According to the principles of Role-Based Access Control (RBAC), what is the correct action to take?

   1. The system should grant the user additional access to the database for auditing purposes.
   2. The system should allow the user to retain access to the database as it is not a security risk.
   3. The system should enforce least privilege by removing the user's access to the database.
   4. The system should not take any action since the user was previously authorized to access the database.

   Answer: C. The system should enforce least privilege by removing the user's access to the database.

   RBAC requires that users are granted only the minimum level of access necessary to perform their job functions. If a user no longer requires access to a specific resource (e.g., a database), the system should enforce least privilege by revoking that access to maintain security and compliance.