Chapter 8: Identity and Access Management

Angela has chosen to federate with other organizations to allow use of services that each organization provides. What role does Angela's organization play when they authenticate their users and assert that those users are valid to other members of the federation?

• Service provider

• Relying party

• Authentication provider

• Identity provider

Answer explanation

Key Phrase: "authenticate their users"

Explanation:
Correct Answer (D): Angela's organization is acting as an Identity Provider (IdP) because it is authenticating users and asserting that they are valid to other federation members.
Why others are wrong:

• A: Service provider provides services, but doesn't authenticate users.

• B: Relying party trusts the IdP’s authentication assertions but doesn't authenticate itself.

• C: Authentication provider is not a formal role in federated authentication.

Which of the following technologies is the least effective means of preventing shared accounts?

• Password complexity requirements

• Requiring biometric authentication

• Requiring one-time passwords via a token

• Requiring a one-time password via an application

Answer explanation

Key Phrase: "preventing shared accounts"

Explanation:
Correct Answer (A): Password complexity requirements do not prevent users from sharing complex passwords. Users may still share passwords that meet the complexity requirements.
Why others are wrong:

• B: Biometric authentication requires physical presence and makes sharing more difficult.

• C & D: One-time passwords (OTP via tokens or applications) are harder to share and much more effective than just requiring complex passwords.

What major difference is likely to exist between on-premises identity services and those used in a cloud-hosted environment?

• Account policy control will be set to the cloud provider's standards.

• The cloud service will provide account and identity management services.

• Multifactor authentication will not be supported by the cloud vendor.

• None of the above.

Answer explanation

Key Phrase: "difference between on-premises and cloud-hosted identity services"

Explanation:
Correct Answer (B): In the cloud, the provider typically offers built-in account and identity management services, whereas on-premises services may require additional setup and maintenance.
Why others are wrong:

• A: While cloud services might set account policies, that’s not the major difference.

• C: Most cloud vendors support multifactor authentication, so this is not the distinguishing factor.

D: The difference is the level of management provided by the service, not "None of the above."

Amitoj wants to ensure that her organization's password policy does not allow users to reset their password multiple times until they can reuse their current password. What setting is used to prevent this?

• Complexity

• Length

• Expiration

• Age

Answer explanation

Key Phrase: "prevent users from resetting their password multiple times"

Explanation:
Correct Answer (D): Password age is the setting that ensures users cannot reset their password too frequently and reuse the old one.
Why others are wrong:

• A, B, C: Complexity, length, and expiration don’t affect the ability to reset and reuse passwords, they affect password creation and lifespan.

Which type of multifactor authentication is considered the least secure?

• HOTP

• SMS

• TOTP

• Biometric

Answer explanation

Key Phrase: "least secure multifactor authentication"

Explanation:
Correct Answer (B): SMS-based multifactor authentication is the least secure because it can be intercepted or hijacked through methods like SIM swapping.
Why others are wrong:

• A: HOTP is more secure as it generates a unique code every time.

• C: TOTP uses time-based codes which are also more secure than SMS.

• D: Biometrics are generally more secure than SMS and harder to spoof.

Geeta has been issued a USB security key as part of her organization's multifactor implementation. What type of implementation is this?

• A hard token

• A biometric token

• A soft token

• An attestation token

Answer explanation

Key Phrase: "USB security key"

Explanation:
Correct Answer (A): A USB security key is a hard token, a physical device that generates or stores authentication credentials.
Why others are wrong:

• B: A biometric token would involve a physical trait like a fingerprint or facial scan, not a USB key.

• C: A soft token is a digital token typically stored in an app or software.

• D: An attestation token is used to verify the integrity of a device, not a user authentication method.

Michelle enables the Windows picture password feature to control logins for her laptop. Which type of attribute will it provide?

• Somewhere you are

• Something you know

• Something you are

• Someone you know

Answer explanation

Key Phrase: "Windows picture password"

Explanation:
Correct Answer (B): A picture password is something the user knows — specific gestures (like taps or swipes) on a picture.
Why others are wrong:

• A: Somewhere you are refers to location-based authentication.

• C: Something you are refers to biometrics like fingerprints or face recognition.

• D: Someone you know is not a factor used in authentication.

What purpose would Linux file permissions set to rw-r--r-- serve?

• To allow the owner to read and write the file, and for the owner's group and others to be able to read it

• To allow all users to read and write the file, and for the group and owner to be able to read it

• To allow system administrators to read and write the file, and for users and all others to be able to read it

• To prevent reading and writing for all users, and to prevent reading by groups and a specific user

Answer explanation

Key Phrase: "Linux file permissions rw-r--r--"

Explanation:
Correct Answer (A): The rw-r--r-- permission setting means the owner can read and write the file, while the group and others can only read it.
Why others are wrong:

B, C, D: These are incorrect because they misinterpret the read, write, and execute permission settings for groups and others.

Teresa wants to implement an access control scheme that sets permissions based on what the individual's job requires. Which of the following schemes is most suited to this type of implementation?

• ABAC

• DAC

• RBAC

• MAC

Answer explanation

Key Phrase: "permissions based on job requirements"

Explanation:
Correct Answer (C): Role-Based Access Control (RBAC) assigns permissions based on the user's role within the organization, which is typically tied to their job responsibilities.
Why others are wrong:

• A: ABAC (Attribute-Based Access Control) uses other attributes, not just the role.

• B: DAC (Discretionary Access Control) gives users control over their own access rights, not job-based roles.

• D: MAC (Mandatory Access Control) is more rigid and enforced by the system, not based on the user's role.

Which of the following biometric technologies is most broadly deployed due to its ease of use and acceptance from end users?

• Voiceprint recognition

• Gait recognition

• Retina scanners

• Fingerprint scanner

Answer explanation

Key Phrase: "most broadly deployed biometric technology"

Explanation:
Correct Answer (D): Fingerprint scanners are one of the most common biometric technologies used on mobile devices and laptops, making them widely deployed.
Why others are wrong:

• A: Voiceprint recognition is used but not as widely accepted or easy to deploy as fingerprint scanners.

• B: Gait recognition is not as commonly deployed.

• C: Retina scanners are specialized and less commonly used.