Practice: Access Management Principles and Procedures

A help desk technician verifies a user's identity before resetting their password. Which AAA function is being performed?

• Authorization

• Authentication

• Accounting

• Access auditing

Answer explanation

Authentication confirms who the user is before any access is granted. Authorization decides what that verified user is allowed to do.

Tags

Blooms Level: Apply

Which action best illustrates the authorization step of AAA?

• Logging the time a user signed in

• Granting a manager access to payroll files

• Prompting the user to enter a password

• Recording total bandwidth used per session

Answer explanation

Authorization assigns permissions after identity is confirmed. Logging sign-in times and bandwidth usage are accounting functions.

Tags

Blooms Level: Apply

A network administrator wants one server to handle logins for all routers and switches. Which protocol fits best?

• DHCP

• RADIUS

• SMTP

• DNS

Answer explanation

RADIUS centralizes authentication, authorization, and accounting for network devices so credentials are managed in one place. DHCP, SMTP, and DNS serve unrelated functions.

Tags

Blooms Level: Apply

Which TWO options qualify as true multifactor authentication? (Select all that apply.)

• A username and a security question

• A fingerprint and a smart card

• Two different passwords entered in sequence

• A password and a one-time code from a phone app

• A password and a PIN

Answer explanation

MFA requires factors from at least two different categories. A fingerprint (something you are) plus a smart card (something you have) qualifies, as does a password (know) plus a phone code (have). Two passwords or two PINs are the same category.

Tags

Blooms Level: Apply

A technician sets a rule requiring passwords to include uppercase, lowercase, numbers, and symbols. Which policy element is this?

• Password length requirement

• Account lockout threshold

• Password history restriction

• Password complexity requirement

Answer explanation

Complexity rules dictate which character types must appear in a password. Length policy only controls the minimum or maximum number of characters.

Tags

Blooms Level: Apply

Which authentication factor type is a retina scan?

• Something you are

• Somewhere you are

• Something you know

• Something you have

Answer explanation

Biometrics measure physical or behavioral traits, placing them in the "something you are" category. A retina scan reads a unique physical characteristic of the user.

Tags

Blooms Level: Remember

Why is biometric data riskier to lose in a breach than a password?

• Biometrics cannot be changed if stolen

• Biometrics work only on mobile devices

• Biometric scanners cost more than keyboards

• Biometric data is stored in plain text

Answer explanation

You can reset a password, but you cannot reissue your fingerprint or iris if it is compromised.

Tags

Blooms Level: Understand

A company stores files in a shared cloud drive. Which access control approach best protects sensitive folders?

• Disable all logins to the cloud service

• Make every folder publicly viewable

• Grant all employees full edit rights

• Apply role-based permissions per folder

Answer explanation

Role-based access limits each user to what their job requires, protecting sensitive data. Granting full rights or public access removes that protection entirely.

Tags

Blooms Level: Apply

Which TWO actions strengthen a password policy against guessing attacks? (Select all that apply.)

• Require a minimum of 12 characters

• Permit users to reuse last month's password

• Lock the account after several failed attempts

• Allow unlimited login attempts

• Display the password in plain text while typing

Answer explanation

Long passwords resist guessing by expanding the search space; account lockouts stop brute-force attempts by limiting tries. Allowing reuse or unlimited attempts weakens security.

Tags

Blooms Level: Apply

A user logs in once and then accesses email, the HR portal, and cloud storage without re-entering credentials. What is this called?

• Account lockout policy

• Multifactor authentication

• Single sign-on

• Privileged access management

Answer explanation

Single sign-on authenticates a user once and grants seamless access to multiple integrated services. Multifactor authentication adds verification steps but does not eliminate repeated logins on its own.

Tags

Blooms Level: Remember