CompTIA Security+ SY0-701 Identity and Access Management Practice Test

 

Topic 19 focuses on Identity and Access Management for the CompTIA Security+ certification and the SY0-701 exam, using practical cybersecurity scenarios aligned to the published Security+ objectives. For broader exam preparation, review the CompTIA Security+ SY0-701 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which term describes creation and assignment of accounts, attributes, groups, and access for an identity?

1. Security key
2. Biometric factor
3. User provisioning
4. Multifactor authentication

Correct Answer: C

 

Correct Answer

Answer C is correct because User provisioning means creation and assignment of accounts, attributes, groups, and access for an identity.

Incorrect Answers

Answer A is incorrect because Security key would fit a different scenario. Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols.

Answer B is incorrect because Biometric factor addresses a different requirement. Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person.

Answer D is incorrect because Multifactor authentication represents a different security function. Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence.

 

Question 2

To prevent former or transferred users from retaining unnecessary access, which security approach should be selected?

1. Password vaulting
2. Mandatory access control (MAC)
3. OAuth
4. User deprovisioning

Correct Answer: D

 

Correct Answer

Answer D is correct because User deprovisioning means removal or disabling of accounts and permissions when access is no longer required.

Incorrect Answers

Answer A is incorrect because Password vaulting addresses a different security requirement. Password vaulting refers to controlled storage and checkout or brokering of privileged credentials.

Answer B is incorrect because Mandatory access control (MAC) addresses a different requirement. Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions.

Answer C is incorrect because OAuth would fit a different scenario. OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

 

Question 3

Which term describes verification of a person’s real-world identity before issuing credentials or establishing an account?

1. OAuth
2. Mandatory access control (MAC)
3. Identity proofing
4. Attestation

Correct Answer: C

 

Correct Answer

Answer C is correct because Identity proofing means verification of a person’s real-world identity before issuing credentials or establishing an account.

Incorrect Answers

Answer A is incorrect because OAuth would fit a different scenario. OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

Answer B is incorrect because Mandatory access control (MAC) represents a different security function. Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions.

Answer D is incorrect because Attestation addresses a different requirement. Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

 

Question 4

To extend identity trust across organizations or services, which security approach should be selected?

1. Hardware token
2. User provisioning
3. Federation
4. Passwordless authentication

Correct Answer: C

 

Correct Answer

Answer C is correct because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials.

Incorrect Answers

Answer A is incorrect because Hardware token addresses a different security requirement. Hardware token refers to a physical device that generates, stores, or proves possession of authentication material.

Answer B is incorrect because User provisioning addresses a different requirement. User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity.

Answer D is incorrect because Passwordless authentication would fit a different scenario. Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.

 

Question 5

Which term describes authentication arrangement that lets a user authenticate once and access multiple integrated services?

1. User provisioning
2. Single sign-on (SSO)
3. Password vaulting
4. Hardware token

Correct Answer: B

 

Correct Answer

Answer B is correct because Single sign-on (SSO) means authentication arrangement that lets a user authenticate once and access multiple integrated services.

Incorrect Answers

Answer A is incorrect because User provisioning represents a different security function. User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity.

Answer C is incorrect because Password vaulting addresses a different requirement. Password vaulting refers to controlled storage and checkout or brokering of privileged credentials.

Answer D is incorrect because Hardware token would fit a different scenario. Hardware token refers to a physical device that generates, stores, or proves possession of authentication material.

 

Question 6

To access directory information used by enterprise identity systems, which security approach should be selected?

1. Hardware token
2. Biometric factor
3. User deprovisioning
4. LDAP

Correct Answer: D

 

Correct Answer

Answer D is correct because LDAP means a protocol for querying and modifying directory services containing identities and related attributes.

Incorrect Answers

Answer A is incorrect because Hardware token addresses a different requirement. Hardware token refers to a physical device that generates, stores, or proves possession of authentication material.

Answer B is incorrect because Biometric factor would fit a different scenario. Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person.

Answer C is incorrect because User deprovisioning addresses a different security requirement. User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required.

 

Question 7

Which authorization framework lets a user grant an application limited access to a resource without sharing the user’s password with that application?

1. Biometric factor
2. User provisioning
3. OAuth
4. Password manager

Correct Answer: C

 

Correct Answer

Answer C is correct because OAuth means an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

Incorrect Answers

Answer A is incorrect because Biometric factor represents a different security function. Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person.

Answer B is incorrect because User provisioning would fit a different scenario. User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity.

Answer D is incorrect because Password manager addresses a different requirement. Password manager refers to software that securely stores and often generates unique credentials.

 

Question 8

To support browser-based enterprise federation and SSO, which security approach should be selected?

1. SAML
2. LDAP
3. Just-in-time permission
4. Discretionary access control (DAC)

Correct Answer: A

 

Correct Answer

Answer A is correct because SAML means an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers.

Incorrect Answers

Answer B is incorrect because LDAP addresses a different security requirement. LDAP refers to a protocol for querying and modifying directory services containing identities and related attributes.

Answer C is incorrect because Just-in-time permission addresses a different requirement. Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period.

Answer D is incorrect because Discretionary access control (DAC) would fit a different scenario. Discretionary access control (DAC) refers to an access model in which resource owners can grant or modify access permissions.

 

Question 9

Which term describes formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid?

1. Least privilege
2. Attestation
3. OAuth
4. User provisioning

Correct Answer: B

 

Correct Answer

Answer B is correct because Attestation means formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

Incorrect Answers

Answer A is incorrect because Least privilege addresses a different requirement. Least privilege refers to the principle of granting only the access required to perform assigned duties.

Answer C is incorrect because OAuth represents a different security function. OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

Answer D is incorrect because User provisioning would fit a different scenario. User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity.

 

Question 10

To enforce strict system-controlled information-flow rules, which security approach should be selected?

1. Privileged access management (PAM)
2. Mandatory access control (MAC)
3. Attestation
4. Just-in-time permission

Correct Answer: B

 

Correct Answer

Answer B is correct because Mandatory access control (MAC) means an access model in which centrally defined labels and policy determine access and users cannot freely change permissions.

Incorrect Answers

Answer A is incorrect because Privileged access management (PAM) would fit a different scenario. Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access.

Answer C is incorrect because Attestation addresses a different requirement. Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

Answer D is incorrect because Just-in-time permission addresses a different security requirement. Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period.

 

Question 11

What is an access model in which resource owners can grant or modify access permissions?

1. Just-in-time permission
2. Ephemeral credential
3. User deprovisioning
4. Discretionary access control (DAC)

Correct Answer: D

 

Correct Answer

Answer D is correct because Discretionary access control (DAC) means an access model in which resource owners can grant or modify access permissions.

Incorrect Answers

Answer A is incorrect because Just-in-time permission addresses a different requirement. Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period.

Answer B is incorrect because Ephemeral credential represents a different security function. Ephemeral credential refers to a short-lived credential created for a limited session or task.

Answer C is incorrect because User deprovisioning would fit a different scenario. User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required.

 

Question 12

To manage access efficiently for groups with common responsibilities, which security approach should be selected?

1. Multifactor authentication
2. Role-based access control (RBAC)
3. User deprovisioning
4. Attribute-based access control (ABAC)

Correct Answer: B

 

Correct Answer

Answer B is correct because Role-based access control (RBAC) means an access model that assigns permissions to job roles and then assigns users to those roles.

Incorrect Answers

Answer A is incorrect because Multifactor authentication would fit a different scenario. Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence.

Answer C is incorrect because User deprovisioning addresses a different requirement. User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required.

Answer D is incorrect because Attribute-based access control (ABAC) addresses a different security requirement. Attribute-based access control (ABAC) refers to an access model that evaluates attributes of users, resources, actions, and environment.

 

Question 13

Which access model evaluates attributes of users, resources, actions, and environment?

1. OAuth
2. Single sign-on (SSO)
3. Attribute-based access control (ABAC)
4. Multifactor authentication

Correct Answer: C

 

Correct Answer

Answer C is correct because Attribute-based access control (ABAC) means an access model that evaluates attributes of users, resources, actions, and environment.

Incorrect Answers

Answer A is incorrect because OAuth represents a different security function. OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

Answer B is incorrect because Single sign-on (SSO) would fit a different scenario. Single sign-on (SSO) refers to authentication arrangement that lets a user authenticate once and access multiple integrated services.

Answer D is incorrect because Multifactor authentication addresses a different requirement. Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence.

 

Question 14

To reduce misuse and limit impact if an account is compromised, which security approach should be selected?

1. Mandatory access control (MAC)
2. Discretionary access control (DAC)
3. Security key
4. Least privilege

Correct Answer: D

 

Correct Answer

Answer D is correct because Least privilege means the principle of granting only the access required to perform assigned duties.

Incorrect Answers

Answer A is incorrect because Mandatory access control (MAC) addresses a different security requirement. Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions.

Answer B is incorrect because Discretionary access control (DAC) would fit a different scenario. Discretionary access control (DAC) refers to an access model in which resource owners can grant or modify access permissions.

Answer C is incorrect because Security key addresses a different requirement. Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols.

 

Question 15

Which term describes authentication using factors from more than one category such as knowledge, possession, or inherence?

1. Multifactor authentication
2. User deprovisioning
3. Least privilege
4. SAML

Correct Answer: A

 

Correct Answer

Answer A is correct because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence.

Incorrect Answers

Answer B is incorrect because User deprovisioning represents a different security function. User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required.

Answer C is incorrect because Least privilege addresses a different requirement. Least privilege refers to the principle of granting only the access required to perform assigned duties.

Answer D is incorrect because SAML would fit a different scenario. SAML refers to an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers.

 

Question 16

To use something the user is as part of identity verification, which security approach should be selected?

1. Hardware token
2. Security key
3. Passwordless authentication
4. Biometric factor

Correct Answer: D

 

Correct Answer

Answer D is correct because Biometric factor means an authentication factor based on a physical or behavioral characteristic of a person.

Incorrect Answers

Answer A is incorrect because Hardware token addresses a different security requirement. Hardware token refers to a physical device that generates, stores, or proves possession of authentication material.

Answer B is incorrect because Security key would fit a different scenario. Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols.

Answer C is incorrect because Passwordless authentication addresses a different requirement. Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.

 

Question 17

Which physical device generates, stores, or proves possession of authentication material?

1. Hardware token
2. Federation
3. Multifactor authentication
4. Discretionary access control (DAC)

Correct Answer: A

 

Correct Answer

Answer A is correct because Hardware token means a physical device that generates, stores, or proves possession of authentication material.

Incorrect Answers

Answer B is incorrect because Federation represents a different security function. Federation refers to trust arrangement that lets identities from one security domain access resources in another without separate local credentials.

Answer C is incorrect because Multifactor authentication would fit a different scenario. Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence.

Answer D is incorrect because Discretionary access control (DAC) addresses a different requirement. Discretionary access control (DAC) refers to an access model in which resource owners can grant or modify access permissions.

 

Question 18

To provide phishing-resistant possession-based authentication, which security approach should be selected?

1. Privileged access management (PAM)
2. Security key
3. Attestation
4. Biometric factor

Correct Answer: B

 

Correct Answer

Answer B is correct because Security key means a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols.

Incorrect Answers

Answer A is incorrect because Privileged access management (PAM) addresses a different requirement. Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access.

Answer C is incorrect because Attestation would fit a different scenario. Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

Answer D is incorrect because Biometric factor addresses a different security requirement. Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person.

 

Question 19

Which term describes software that securely stores and often generates unique credentials?

1. Ephemeral credential
2. User provisioning
3. Single sign-on (SSO)
4. Password manager

Correct Answer: D

 

Correct Answer

Answer D is correct because Password manager means software that securely stores and often generates unique credentials.

Incorrect Answers

Answer A is incorrect because Ephemeral credential would fit a different scenario. Ephemeral credential refers to a short-lived credential created for a limited session or task.

Answer B is incorrect because User provisioning addresses a different requirement. User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity.

Answer C is incorrect because Single sign-on (SSO) represents a different security function. Single sign-on (SSO) refers to authentication arrangement that lets a user authenticate once and access multiple integrated services.

 

Question 20

To reduce phishing and password-reuse risk, which security approach should be selected?

1. Least privilege
2. Attestation
3. Privileged access management (PAM)
4. Passwordless authentication

Correct Answer: D

 

Correct Answer

Answer D is correct because Passwordless authentication means authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.

Incorrect Answers

Answer A is incorrect because Least privilege addresses a different requirement. Least privilege refers to the principle of granting only the access required to perform assigned duties.

Answer B is incorrect because Attestation addresses a different security requirement. Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

Answer C is incorrect because Privileged access management (PAM) would fit a different scenario. Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access.

 

Question 21

Which term describes processes and tools that tightly control, monitor, and audit administrative or high-impact access?

1. Attribute-based access control (ABAC)
2. OAuth
3. Privileged access management (PAM)
4. Passwordless authentication

Correct Answer: C

 

Correct Answer

Answer C is correct because Privileged access management (PAM) means processes and tools that tightly control, monitor, and audit administrative or high-impact access.

Incorrect Answers

Answer A is incorrect because Attribute-based access control (ABAC) addresses a different requirement. Attribute-based access control (ABAC) refers to an access model that evaluates attributes of users, resources, actions, and environment.

Answer B is incorrect because OAuth would fit a different scenario. OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

Answer D is incorrect because Passwordless authentication represents a different security function. Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.

 

Question 22

To minimize standing privileged access, which security approach should be selected?

1. Password vaulting
2. OAuth
3. Mandatory access control (MAC)
4. Just-in-time permission

Correct Answer: D

 

Correct Answer

Answer D is correct because Just-in-time permission means temporary elevation granted only when needed and removed automatically after a short period.

Incorrect Answers

Answer A is incorrect because Password vaulting would fit a different scenario. Password vaulting refers to controlled storage and checkout or brokering of privileged credentials.

Answer B is incorrect because OAuth addresses a different security requirement. OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

Answer C is incorrect because Mandatory access control (MAC) addresses a different requirement. Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions.

 

Question 23

Which term describes controlled storage and checkout or brokering of privileged credentials?

1. Password vaulting
2. Just-in-time permission
3. Single sign-on (SSO)
4. Ephemeral credential

Correct Answer: A

 

Correct Answer

Answer A is correct because Password vaulting means controlled storage and checkout or brokering of privileged credentials.

Incorrect Answers

Answer B is incorrect because Just-in-time permission would fit a different scenario. Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period.

Answer C is incorrect because Single sign-on (SSO) addresses a different requirement. Single sign-on (SSO) refers to authentication arrangement that lets a user authenticate once and access multiple integrated services.

Answer D is incorrect because Ephemeral credential represents a different security function. Ephemeral credential refers to a short-lived credential created for a limited session or task.

 

Question 24

To reduce risk from long-lived reusable secrets, which security approach should be selected?

1. Ephemeral credential
2. Privileged access management (PAM)
3. Single sign-on (SSO)
4. OAuth

Correct Answer: A

 

Correct Answer

Answer A is correct because Ephemeral credential means a short-lived credential created for a limited session or task.

Incorrect Answers

Answer B is incorrect because Privileged access management (PAM) addresses a different requirement. Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access.

Answer C is incorrect because Single sign-on (SSO) would fit a different scenario. Single sign-on (SSO) refers to authentication arrangement that lets a user authenticate once and access multiple integrated services.

Answer D is incorrect because OAuth addresses a different security requirement. OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

 

Question 25

To grant a new or changing user the access required for their role, which security approach should be selected?

1. Privileged access management (PAM)
2. Security key
3. User provisioning
4. Passwordless authentication

Correct Answer: C

 

Correct Answer

Answer C is correct because User provisioning means creation and assignment of accounts, attributes, groups, and access for an identity.

Incorrect Answers

Answer A is incorrect because Privileged access management (PAM) represents a different security function. Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access.

Answer B is incorrect because Security key would fit a different scenario. Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols.

Answer D is incorrect because Passwordless authentication addresses a different security requirement. Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.

 

Question 26

Which term describes removal or disabling of accounts and permissions when access is no longer required?

1. User deprovisioning
2. Federation
3. Ephemeral credential
4. Least privilege

Correct Answer: A

 

Correct Answer

Answer A is correct because User deprovisioning means removal or disabling of accounts and permissions when access is no longer required.

Incorrect Answers

Answer B is incorrect because Federation addresses a different requirement. Federation refers to trust arrangement that lets identities from one security domain access resources in another without separate local credentials.

Answer C is incorrect because Ephemeral credential represents a different security function. Ephemeral credential refers to a short-lived credential created for a limited session or task.

Answer D is incorrect because Least privilege addresses a different security requirement. Least privilege refers to the principle of granting only the access required to perform assigned duties.

 

Question 27

To ensure the digital identity is bound to the correct individual, which security approach should be selected?

1. Passwordless authentication
2. Attestation
3. User deprovisioning
4. Identity proofing

Correct Answer: D

 

Correct Answer

Answer D is correct because Identity proofing means verification of a person’s real-world identity before issuing credentials or establishing an account.

Incorrect Answers

Answer A is incorrect because Passwordless authentication represents a different security function. Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.

Answer B is incorrect because Attestation addresses a different security requirement. Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

Answer C is incorrect because User deprovisioning would fit a different scenario. User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required.

 

Question 28

Which term describes trust arrangement that lets identities from one security domain access resources in another without separate local credentials?

1. Multifactor authentication
2. Password manager
3. Federation
4. Identity proofing

Correct Answer: C

 

Correct Answer

Answer C is correct because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials.

Incorrect Answers

Answer A is incorrect because Multifactor authentication addresses a different requirement. Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence.

Answer B is incorrect because Password manager addresses a different security requirement. Password manager refers to software that securely stores and often generates unique credentials.

Answer D is incorrect because Identity proofing represents a different security function. Identity proofing refers to verification of a person’s real-world identity before issuing credentials or establishing an account.

 

Question 29

To reduce repeated logins while centralizing authentication control, which security approach should be selected?

1. User deprovisioning
2. Single sign-on (SSO)
3. Attestation
4. Biometric factor

Correct Answer: B

 

Correct Answer

Answer B is correct because Single sign-on (SSO) means authentication arrangement that lets a user authenticate once and access multiple integrated services.

Incorrect Answers

Answer A is incorrect because User deprovisioning addresses a different security requirement. User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required.

Answer C is incorrect because Attestation represents a different security function. Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

Answer D is incorrect because Biometric factor would fit a different scenario. Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person.

 

Question 30

What is a protocol for querying and modifying directory services containing identities and related attributes?

1. Identity proofing
2. LDAP
3. Ephemeral credential
4. OAuth

Correct Answer: B

 

Correct Answer

Answer B is correct because LDAP means a protocol for querying and modifying directory services containing identities and related attributes.

Incorrect Answers

Answer A is incorrect because Identity proofing addresses a different security requirement. Identity proofing refers to verification of a person’s real-world identity before issuing credentials or establishing an account.

Answer C is incorrect because Ephemeral credential addresses a different requirement. Ephemeral credential refers to a short-lived credential created for a limited session or task.

Answer D is incorrect because OAuth represents a different security function. OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

 

Question 31

To delegate scoped API access between applications and services, which security approach should be selected?

1. OAuth
2. Privileged access management (PAM)
3. Biometric factor
4. Least privilege

Correct Answer: A

 

Correct Answer

Answer A is correct because OAuth means an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

Incorrect Answers

Answer B is incorrect because Privileged access management (PAM) addresses a different security requirement. Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access.

Answer C is incorrect because Biometric factor represents a different security function. Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person.

Answer D is incorrect because Least privilege would fit a different scenario. Least privilege refers to the principle of granting only the access required to perform assigned duties.

 

Question 32

Which XML-based standard commonly is used to exchange authentication and authorization assertions between identity providers and service providers?

1. SAML
2. User deprovisioning
3. OAuth
4. Identity proofing

Correct Answer: A

 

Correct Answer

Answer A is correct because SAML means an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers.

Incorrect Answers

Answer B is incorrect because User deprovisioning addresses a different security requirement. User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required.

Answer C is incorrect because OAuth addresses a different requirement. OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.

Answer D is incorrect because Identity proofing represents a different security function. Identity proofing refers to verification of a person’s real-world identity before issuing credentials or establishing an account.

 

Question 33

To periodically verify that access or compliance assertions are still appropriate, which security approach should be selected?

1. Attestation
2. Ephemeral credential
3. Security key
4. Attribute-based access control (ABAC)

Correct Answer: A

 

Correct Answer

Answer A is correct because Attestation means formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

Incorrect Answers

Answer B is incorrect because Ephemeral credential addresses a different security requirement. Ephemeral credential refers to a short-lived credential created for a limited session or task.

Answer C is incorrect because Security key would fit a different scenario. Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols.

Answer D is incorrect because Attribute-based access control (ABAC) represents a different security function. Attribute-based access control (ABAC) refers to an access model that evaluates attributes of users, resources, actions, and environment.

 

Question 34

What is an access model in which centrally defined labels and policy determine access and users cannot freely change permissions?

1. Just-in-time permission
2. Passwordless authentication
3. Password vaulting
4. Mandatory access control (MAC)

Correct Answer: D

 

Correct Answer

Answer D is correct because Mandatory access control (MAC) means an access model in which centrally defined labels and policy determine access and users cannot freely change permissions.

Incorrect Answers

Answer A is incorrect because Just-in-time permission addresses a different security requirement. Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period.

Answer B is incorrect because Passwordless authentication represents a different security function. Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.

Answer C is incorrect because Password vaulting addresses a different requirement. Password vaulting refers to controlled storage and checkout or brokering of privileged credentials.

 

Question 35

To let owners delegate access to resources they control, which security approach should be selected?

1. Federation
2. LDAP
3. Discretionary access control (DAC)
4. Security key

Correct Answer: C

 

Correct Answer

Answer C is correct because Discretionary access control (DAC) means an access model in which resource owners can grant or modify access permissions.

Incorrect Answers

Answer A is incorrect because Federation addresses a different security requirement. Federation refers to trust arrangement that lets identities from one security domain access resources in another without separate local credentials.

Answer B is incorrect because LDAP represents a different security function. LDAP refers to a protocol for querying and modifying directory services containing identities and related attributes.

Answer D is incorrect because Security key would fit a different scenario. Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols.

 

Question 36

Which access model assigns permissions to job roles and then assigns users to those roles?

1. Mandatory access control (MAC)
2. Role-based access control (RBAC)
3. User deprovisioning
4. Ephemeral credential

Correct Answer: B

 

Correct Answer

Answer B is correct because Role-based access control (RBAC) means an access model that assigns permissions to job roles and then assigns users to those roles.

Incorrect Answers

Answer A is incorrect because Mandatory access control (MAC) addresses a different requirement. Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions.

Answer C is incorrect because User deprovisioning addresses a different security requirement. User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required.

Answer D is incorrect because Ephemeral credential represents a different security function. Ephemeral credential refers to a short-lived credential created for a limited session or task.

 

Question 37

To make fine-grained dynamic authorization decisions from contextual policy, which security approach should be selected?

1. Attribute-based access control (ABAC)
2. Ephemeral credential
3. SAML
4. Attestation

Correct Answer: A

 

Correct Answer

Answer A is correct because Attribute-based access control (ABAC) means an access model that evaluates attributes of users, resources, actions, and environment.

Incorrect Answers

Answer B is incorrect because Ephemeral credential would fit a different scenario. Ephemeral credential refers to a short-lived credential created for a limited session or task.

Answer C is incorrect because SAML addresses a different security requirement. SAML refers to an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers.

Answer D is incorrect because Attestation represents a different security function. Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

 

Question 38

What is the principle of granting only the access required to perform assigned duties?

1. Security key
2. Least privilege
3. Attestation
4. Discretionary access control (DAC)

Correct Answer: B

 

Correct Answer

Answer B is correct because Least privilege means the principle of granting only the access required to perform assigned duties.

Incorrect Answers

Answer A is incorrect because Security key represents a different security function. Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols.

Answer C is incorrect because Attestation addresses a different security requirement. Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.

Answer D is incorrect because Discretionary access control (DAC) addresses a different requirement. Discretionary access control (DAC) refers to an access model in which resource owners can grant or modify access permissions.

 

Question 39

To reduce account takeover risk when one credential factor is stolen, which security approach should be selected?

1. Ephemeral credential
2. Multifactor authentication
3. Passwordless authentication
4. Privileged access management (PAM)

Correct Answer: B

 

Correct Answer

Answer B is correct because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence.

Incorrect Answers

Answer A is incorrect because Ephemeral credential represents a different security function. Ephemeral credential refers to a short-lived credential created for a limited session or task.

Answer C is incorrect because Passwordless authentication would fit a different scenario. Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.

Answer D is incorrect because Privileged access management (PAM) addresses a different security requirement. Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access.

 

Question 40

An organization uses fingerprint comparison for remote digital authentication. Under NIST biometric guidance, what must be authenticated alongside the biometric comparison?

1. A password as the only additional mechanism
2. A second biometric characteristic without a physical authenticator
3. A physical authenticator that establishes possession
4. An answer to a personal knowledge question

Correct Answer: C

 

Correct Answer

Answer C is correct because a biometric comparison must be combined with authentication of a physical authenticator. The physical authenticator establishes possession, while the biometric comparison supplies an inherence factor.

Incorrect Answers

Answer A is incorrect because a password supplies a knowledge factor but does not establish possession of the physical authenticator required by the cited guidance.

Answer B is incorrect because another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator.

Answer D is incorrect because a personal knowledge answer does not authenticate a physical authenticator or establish possession.