In a university setting, students log in with a campus-wide credential that allows access to email, library databases, and learning portals. What identity concept is being used?

A company uses LinkedIn credentials to allow users to sign into their internal training platform. What identity federation technique is this?

While onboarding, an employee is asked to provide a government-issued ID and utility bill. What process is taking place?

What identity type describes the unique characteristics and records associated with a user in a system?

An employee’s access is automatically revoked once they leave the company. What process ensures this occurs?

What identity model requires credentials to be validated by a third-party identity provider across multiple domains?

Which of the following best defines an identity as used in Identity and Access Management (IAM)?

Which of the following is NOT an example of identity data?

What is the purpose of a directory service in identity management?

In which scenario would identity federation be most useful?

What is the primary concern if an identity provider (IdP) is compromised in a federated identity system?

What identity principle ensures users are only given the minimum levels of access necessary?

Which of these best describes the relationship between an identity provider and a relying party?

Which format is commonly used in SAML-based federated identity systems?

A company requires employees to authenticate via a QR code tied to their mobile identity app. What authentication mechanism is being used?

Why is an identity lifecycle important in IAM?

What identity concept helps define access based on a user’s attributes like department or job function?

What component of IAM verifies that a person is who they claim to be?

An organization links its cloud file storage service to its internal Active Directory for login purposes. This is an example of:

Which of the following best supports the concept of identity assurance?

A hospital uses a system where a staff member’s access is dictated by their job (doctor, nurse, admin). This is an example of:

What is typically the first phase in the identity lifecycle?

What document formally outlines how identities are issued, validated, and managed?

Which of the following best describes the goal of IAM in an enterprise?

An organization requires employees to use a password and a fingerprint to access a secure database. What is this an example of?

Which of the following is considered something you have in an authentication context?

What protocol is typically used in Kerberos authentication?

A system uses a challenge-response mechanism to authenticate users without sending passwords over the network. What protocol is likely being used?

What is the main purpose of RADIUS in an authentication environment?

What type of access control model assigns permissions based on job titles or functions?

Which factor is used when authentication is based on retinal scanning?

An online banking application sends a one-time code via SMS in addition to a password. What is this technique called?

What does the principle of least privilege help prevent?

In OAuth 2.0, what is the purpose of the access token?

What protocol does Microsoft Active Directory commonly use for user authentication?

What type of access control gives the "owner" of a file the discretion to decide who else can access it?

Which of the following best describes TACACS+?

A company uses a fingerprint scanner on its employee entrance and an ID badge swipe. What best describes this approach?

In SAML, what is the system that provides authentication and issues assertions called?

What is the primary goal of authorization in access management?

Which of the following is NOT considered a secure authentication method?

Which access model is used when access rights are granted based on user and environmental attributes such as time of day or location?

A cloud application uses SAML to allow users to log in using their enterprise credentials. What is this called?

Which component ensures only authorized users can view or modify resources after logging in?

What mechanism allows users to authenticate once and gain access to multiple systems without re-entering credentials?

Which of these protocols is used to enable web-based Single Sign-On (SSO)?

In a certificate-based authentication system, what is required on the client side?

Which term describes a system that both authenticates users and decides whether they are allowed to access specific resources?

Which authentication method involves using a changing numeric code generated by a physical or software token?

What authentication factor is used when logging in with a USB security key?

What protocol uses tokens and allows one application to access resources on another application without exposing passwords?

Which of the following is NOT considered a secure method of password storage?

What biometric method analyzes the unique pattern of ridges and valleys on a person’s finger?

What is a key benefit of using biometric authentication?

A company implements facial recognition at entry points. What type of authentication method is this?

Which protocol is most commonly used in VPN authentication and can carry a variety of methods, including certificates?

What is HOTP primarily used for?

Which is an example of knowledge-based authentication?

Which technology is often used to implement certificate-based authentication?

Why is biometric authentication considered more secure than passwords?

Which method can be used to verify that a password was not altered in transit?

What authentication protocol supports single sign-on and works across different domains?

What makes TOTP more secure than HOTP in many environments?

A hardware security module (HSM) is used for what authentication purpose?

Which type of authentication requires a certificate stored on the device to verify user identity?

Which of the following is most likely to help protect against credential stuffing attacks?

Which biometric method is often considered the most accurate?

An enterprise uses certificates installed on laptops to authenticate to Wi-Fi. What is this called?

A user's identity is verified by swiping a badge and entering a PIN. What type of authentication is this?

What makes OAuth 2.0 preferable for mobile app authentication?

Which method uses a time-based algorithm and shared secret key for code generation?

A certificate is revoked due to suspected compromise. Where is this status made publicly available?

Which authentication method offers the highest resistance to phishing?

A new employee is assigned a user account with access to specific folders and email systems. What process is this an example of?

What is the primary purpose of implementing account expiration for temporary accounts?

What type of account should a system administrator use for everyday tasks like checking email?

Which of the following is considered a privileged account?

What process ensures inactive or orphaned accounts are detected and removed?

Which of the following is a best practice for managing default accounts on systems?

A user leaves an organization, but their account is not disabled. What type of risk does this represent?

What type of account is typically used by software to run background processes?

A system is configured to require re-approval of accounts every 90 days. What is this practice called?

Which feature allows tracking who accessed or modified a specific user account?

Why should administrator accounts not be used for daily tasks?

A developer is given a separate account with elevated privileges to deploy applications. This is an example of:

What term describes an account that is shared between multiple users?

A manager notices a former employee’s account is still active in HR systems. What control failed?

What is the main security concern with using shared accounts?

What is the purpose of enforcing unique user IDs?

What is the benefit of implementing a role-based account model?

An attacker gains access to a disabled employee account. What principle was violated?

Which setting can help detect if multiple logins are occurring from one account simultaneously?

A contractor is hired for 30 days. What type of account should be created?

What should happen to accounts of users who go on long-term leave?

Which of the following is NOT a common type of account?

Why should service accounts be monitored closely?

What control helps prevent misuse of accounts after termination?

A financial institution requires approval from two managers to create new high-level user accounts. What is this control?

What type of access control relies on labels such as "Confidential" or "Top Secret"?