Identity and Access Management (IAM) practice questions

Answer: A) FIDO2 passkeys unlocked with a local biometric or PIN

Passkeys (FIDO2/WebAuthn) replace passwords with key pairs bound to the legitimate site's origin. Because no typed secret can be relayed, they resist adversary-in-the-middle phishing, which SMS, email and TOTP codes do not.

• ACorrect. Passkeys use origin-bound public-key cryptography. The authenticator signs a challenge only for the relying party the passkey was registered with, and no reusable secret is typed or sent, so a relay site has nothing it can replay. This holds for both device-bound and synced passkeys.
• BIncorrect. This removes the password, but the user still types the SMS code into whatever page is shown, so an adversary-in-the-middle site can capture and relay it.
• CIncorrect. This keeps the password, and the TOTP code is not tied to the site's origin, so a real-time relay can phish both values.
• DIncorrect. Like SMS codes, an email code is a secret the user types in. It can be harvested and relayed by a phishing proxy.

Answer: A) It reduces password fatigue and reuse, but one stolen SSO credential can unlock every connected application

SSO cuts password fatigue and reuse, but it turns one credential into a key for many systems. That is why strong authentication such as MFA on the SSO sign-in is critical.

• ACorrect. With SSO, one set of credentials opens every assigned app. That cuts down on password sprawl, but it also concentrates risk in a single credential and identity provider, so strong protection such as MFA on the SSO sign-in is essential.
• BIncorrect. With federated SSO (SAML or OIDC), the identity provider verifies the user and sends an assertion or token, so apps no longer manage usernames and passwords themselves.
• CIncorrect. MFA is commonly enforced at the identity provider's sign-in, for example through Conditional Access. This is the main way to reduce SSO's concentration risk.
• DIncorrect. Centralizing makes access management easier: administrators control app assignments from the identity provider and can remove access to specific apps.

Answer: A) The client presents its ticket-granting ticket to the KDC, receives a service ticket, and presents that ticket to the file service

Kerberos uses a trusted KDC: the TGT obtained at sign-in is exchanged for service tickets, so the password isn't sent for each service request and both parties can verify each other. NTLM, by contrast, relies on pass-through validation with a domain controller and doesn't authenticate the server.

• AAfter initial sign-in, the client holds a TGT. It uses the TGT to get a service ticket from the KDC and presents that ticket to the service. The password isn't sent again, the service can verify the client without contacting a domain controller each time, and Kerberos also lets the client verify the server (mutual authentication).
• BThis is NTLM pass-through authentication. Kerberos replaces pass-through with tickets, so the server doesn't have to contact a domain controller for each client connection.
• CKerberos is built on a trusted third party (the KDC) and tickets. It doesn't send the user's password to each service, and services don't keep local copies of user passwords.
• DThis describes SAML web SSO, where a browser carries an XML assertion to a service provider. Kerberos uses KDC-issued tickets, not XML assertions.

Answer: A) Separation of duties, which splits a sensitive process so no one user can complete it alone

Assigning creation and approval to separate roles that no single user may hold together is separation of duties. Least privilege, dual control and job rotation are related controls but do not describe this mechanism.

• ACorrect. Treating the creator and approver roles as incompatible stops one identity from both starting and authorizing a transfer. That is separation of duties enforced at the system level.
• BIncorrect. Least privilege limits how much access each user gets. If a job legitimately included both tasks, least privilege alone would still allow both. It does not forbid conflicting combinations.
• CIncorrect. Dual control means two people must act jointly on the same step, such as two key holders opening a vault. In this scenario, separate steps are assigned to separate roles that can't be combined, which is separation of duties.
• DIncorrect. Job rotation helps detect fraud and reduces dependence on one person. It does not stop one user from holding both conflicting roles at the same time.

Answer: A) Use a group managed service account with automatic password rotation, deny interactive sign-in, and grant only the rights the backup job needs

Service accounts should use managed, automatically rotated credentials (such as a gMSA), be denied interactive sign-in, and follow least privilege. Privileged group membership, static passwords, and shared accounts all add risk.

• ACorrect. Microsoft recommends gMSAs where supported because the system manages and rotates their passwords. Service accounts should also be denied interactive sign-in and given only the permissions their service needs.
• BIncorrect. Service accounts shouldn't be members of privileged groups. That membership grants far more access than the backup job needs and makes the account a high-value target.
• CIncorrect. A static password kept in a config file is easy to steal and stays valid indefinitely. Password changes should follow a managed, regular process, ideally automated with a managed service account.
• DIncorrect. Each service should have its own service account for auditing and security. A shared account hides which service did what and widens the damage if it is compromised.

Answer: A) TACACS+

• ATACACS+ encrypts the whole payload and handles AAA functions separately.
• BRADIUS encrypts only the password and combines authentication and authorization.
• CTelnet is an unencrypted remote access protocol.
• DSNMPv1 is an unencrypted management protocol.

Answer: A) A leaver-process failure; trigger account disablement from HR termination events through automated lifecycle workflows

Enabled accounts for departed employees mean the leaver (deprovisioning) step failed. Tying account disablement to HR termination events through an automated joiner-mover-leaver process prevents these orphaned accounts.

• ACorrect. These people left the organization, so the leaver step failed to revoke their access. Linking deprovisioning to authoritative HR data and automating it means accounts are disabled promptly when someone is terminated.
• BMover controls deal with access building up when someone changes roles inside the organization. The accounts found here belong to people who left entirely, which is a leaver failure.
• CApproval at onboarding controls how accounts are created. It does nothing to remove accounts when employment ends.
• DMFA may reduce misuse, but the orphaned accounts would still exist and stay enabled. The root cause is that deprovisioning failed.

Answer: A) Have HR-driven mover events automatically remove the prior role's entitlements when the new role's access is provisioned

Leftover permissions after transfers are a mover-process failure. Automating the mover event so the old role's access is removed when the new role's access is granted fixes this at the source, while access reviews stay as a detective backstop.

• APrivilege creep builds up because transfers add access but don't remove it. If a role change triggers an automated mover process that replaces old entitlements instead of adding to them, the root cause is gone and reviews become a lighter backstop.
• BMore frequent reviews shorten how long excess access lasts, but they're still detective. Leftover permissions keep piling up after every transfer and only get cleaned up later.
• CApproving new access controls what gets added. It does nothing to remove the entitlements left over from the user's previous role.
• DLeaver automation handles people who leave the organization. The problem here is internal movers who keep old access while still employed, so it isn't addressed.

Answer: A) Just-in-time provisioning

• AJIT provisioning creates accounts on first sign-in using identity attributes from the IdP.
• BLockout disables accounts after failed attempts.
• CMandatory vacation is a personnel control.
• DKey escrow stores copies of keys.

Answer: A) Registration and proofing

• AIdentity proofing at registration establishes that the person is who they claim to be.
• BDeprovisioning removes access when it's no longer needed.
• CAccounting records actions taken.
• DFederation shares identities across organizations.