Read each question and choose an answer before opening its explanation. The rationale explains why the keyed response best meets the scenario and why attractive alternatives fall short.
Question 1·Objective 5.2: Identification/authentication strategy: roles, AAA, MFA/passwordless, sessions, identity proofing, federation, credentials, SSO, and just-in-time access
Employees are repeatedly tricked into entering passwords and one-time codes into realistic proxy phishing sites. Which authentication change would MOST directly reduce this attack's effectiveness?
- A.Require longer passwords every 30 days
- B.Add more knowledge-based security questions
- C.Send two one-time codes instead of one
- D.Adopt verifier-bound phishing-resistant cryptographic authenticators
Show answer and explanation
Best answer: D. Adopt verifier-bound phishing-resistant cryptographic authenticators
Verifier-bound cryptographic authentication resists credential replay at an impostor domain, directly addressing adversary-in-the-middle phishing.
A: Password complexity and rotation do not prevent real-time proxy capture.
B: Knowledge questions are reusable secrets and are not phishing resistant.
C: A proxy can relay multiple codes.
D: Verifier-bound cryptographic authentication resists credential replay at an impostor domain, directly addressing adversary-in-the-middle phishing.
Question 2·Objective 5.3: Third-party federation across on-premises, cloud, and hybrid environments
A relying application accepts a signed federation assertion intended for a different application at the same company. Which missing validation MOST likely allowed the acceptance?
- A.Checking the assertion's audience restriction
- B.Hashing the user's password again
- C.Increasing the identity provider's session timeout
- D.Changing the user's display name
Show answer and explanation
Best answer: A. Checking the assertion's audience restriction
Audience validation ensures that a relying party accepts only assertions issued for it, preventing a valid token for one service from being replayed to another.
A: Audience validation ensures that a relying party accepts only assertions issued for it, preventing a valid token for one service from being replayed to another.
B: The relying party need not rehash a password contained nowhere in the assertion.
C: Session duration does not determine the assertion's intended recipient.
D: Display names do not bind a token to its audience.
Question 3·Objective 5.4: RBAC, rule-based, MAC, DAC, ABAC, risk-based access, and policy decision/enforcement
A hospital must allow clinicians to view records only when their specialty, current care-team assignment, device compliance, and patient relationship satisfy policy. Which authorization model BEST fits these dynamic conditions?
- A.Discretionary access control based only on record creator choice
- B.Mandatory access control using only two fixed classifications
- C.A single shared clinical account
- D.Attribute-based access control
Show answer and explanation
Best answer: D. Attribute-based access control
ABAC evaluates subject, object, action, and environmental attributes, making it suitable for several changing clinical and device conditions.
A: Creator discretion does not consistently enforce enterprise clinical policy.
B: Two static labels cannot express the stated dynamic relationships.
C: Shared accounts destroy accountability and least privilege.
D: ABAC evaluates subject, object, action, and environmental attributes, making it suitable for several changing clinical and device conditions.
Question 4·Objective 5.5: Account reviews, provisioning/deprovisioning, role transitions, privilege escalation, and service accounts
Quarterly access reviews repeatedly find that employees who transfer departments retain privileges from their previous roles. Which control would BEST prevent this condition at its source?
- A.Require employees to report access they no longer need during annual training
- B.Increase the frequency of manual reviews for privileged accounts
- C.Use authoritative personnel events to remove prior-role access and require approval for new-role entitlements
- D.Expire every user account at the end of each quarter and recreate approved accounts
Show answer and explanation
Best answer: C. Use authoritative personnel events to remove prior-role access and require approval for new-role entitlements
An event-driven mover process ties access changes to the authoritative personnel lifecycle, removes obsolete entitlements, and subjects new access to approval. It prevents privilege accumulation instead of relying primarily on later detection.
A: Self-reporting is unreliable and does not enforce timely removal.
B: More reviews may detect accumulated access sooner, but they do not correct the broken transfer process at its source.
C: An event-driven mover process ties access changes to the authoritative personnel lifecycle, removes obsolete entitlements, and subjects new access to approval. It prevents privilege accumulation instead of relying primarily on later detection.
D: Recreating all accounts is disruptive, disproportionate, and can introduce new provisioning errors.
Question 5·Objective 5.6: Authentication-system implementation
A company deploys strong MFA but allows the help desk to reset any account after correctly answering two biographical questions. What is the GREATEST concern?
- A.Recovery creates a weaker path that can bypass the assurance of normal authentication
- B.Users may forget which authenticator color they selected
- C.MFA prevents all account recovery
- D.Biographical questions make passwords longer
Show answer and explanation
Best answer: A. Recovery creates a weaker path that can bypass the assurance of normal authentication
Account recovery is part of the authentication system. Weak, discoverable knowledge checks can bypass stronger authenticators and become the preferred attack path.
A: Account recovery is part of the authentication system. Weak, discoverable knowledge checks can bypass stronger authenticators and become the preferred attack path.
B: Authenticator color is not part of the stated process.
C: MFA does not eliminate the operational need for secure recovery.
D: Recovery questions do not increase password length.
Question 6·Objective 5.1: Physical and logical access to information, systems, devices, facilities, applications, and services
A facilities badge grants access to a server room although the employee's job changed. What failed?
- A.Access adjustment during the role-transition lifecycle
- B.Identity proofing at initial hire
- C.Password hashing
- D.Federation metadata signing
Show answer and explanation
Best answer: A. Access adjustment during the role-transition lifecycle
Physical and logical entitlements must be updated when responsibilities change.
A: Physical and logical entitlements must be updated when responsibilities change.
B: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
C: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
D: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
Question 7·Objective 5.2: Identification/authentication strategy: roles, AAA, MFA/passwordless, sessions, identity proofing, federation, credentials, SSO, and just-in-time access
A help desk resets passwords after asking knowledge-based questions available on social media. What should replace this process?
- A.More personal trivia questions
- B.Risk-appropriate identity verification using stronger evidence
- C.A shared reset password
- D.Emailing the old password
Show answer and explanation
Best answer: B. Risk-appropriate identity verification using stronger evidence
Recovery must resist impersonation and provide assurance appropriate to the account risk.
A: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
B: Recovery must resist impersonation and provide assurance appropriate to the account risk.
C: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
D: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
Question 8·Objective 5.3: Third-party federation across on-premises, cloud, and hybrid environments
A partner's federated users retain access after leaving the partner. What is the BEST architectural improvement?
- A.Trust partner assertions indefinitely
- B.Create shared local accounts
- C.Require timely lifecycle signals and enforce local session and entitlement controls
- D.Disable assertion signatures
Show answer and explanation
Best answer: C. Require timely lifecycle signals and enforce local session and entitlement controls
Federation must include reliable deprovisioning and local enforcement.
A: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
B: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
C: Federation must include reliable deprovisioning and local enforcement.
D: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
Question 9·Objective 5.4: RBAC, rule-based, MAC, DAC, ABAC, risk-based access, and policy decision/enforcement
A hospital permits record access based on role, treatment relationship, location, and current risk. Which model BEST fits?
- A.Discretionary access control only
- B.Mandatory access control using clearance alone
- C.Unauthenticated access
- D.Attribute-based access control
Show answer and explanation
Best answer: D. Attribute-based access control
ABAC evaluates multiple subject, resource, action, and environmental attributes.
A: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
B: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
C: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
D: ABAC evaluates multiple subject, resource, action, and environmental attributes.
Question 10·Objective 5.5: Account reviews, provisioning/deprovisioning, role transitions, privilege escalation, and service accounts
A service account password is embedded in many scripts and never rotated. What should be done FIRST?
- A.Inventory dependencies and migrate to managed, rotatable credentials
- B.Rotate immediately without testing
- C.Publish the password to application owners
- D.Convert it to a human administrator account
Show answer and explanation
Best answer: A. Inventory dependencies and migrate to managed, rotatable credentials
Dependency discovery enables safe migration away from unmanaged static secrets.
A: Dependency discovery enables safe migration away from unmanaged static secrets.
B: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
C: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
D: This option may be useful in another context, but it does not establish the required identity, authorization, or accountability assurance.
Continue studying Identity and Access Management
Review the complete Domain 5 guide, then mix this material with the other seven domains in an adaptive mock exam.