CIAM Identity Proofing and Verification 1 — Questions and Answers
Question 1: According to NIST SP 800-63A, which Identity Assurance Level (IAL) requires in-person or remote proofing with validation of a government-issued ID?
- IAL1
- IAL2 (Correct answer)
- IAL3
- IAL0
Correct answer: IAL2
IAL2 requires remote or in-person identity proofing with validation and verification of at least one piece of identity evidence such as a government-issued ID.
Question 2: What is the primary purpose of 'identity proofing' in the context of Identity and Access Management?
- Granting access permissions to verified users
- Establishing confidence that a claimed identity corresponds to a real individual (Correct answer)
- Encrypting identity credentials for secure storage
- Auditing user activity after authentication
Correct answer: Establishing confidence that a claimed identity corresponds to a real individual
Identity proofing is the process of establishing confidence that a subject claiming an identity is actually who they claim to be, based on evidence and validation.
Question 3: Which NIST Special Publication specifically provides guidelines for digital identity proofing and enrollment?
- NIST SP 800-53
- NIST SP 800-171
- NIST SP 800-63A (Correct answer)
- NIST SP 800-37
Correct answer: NIST SP 800-63A
NIST SP 800-63A specifically addresses enrollment and identity proofing, defining the processes and requirements for each Identity Assurance Level.
Question 4: What is 'liveness detection' used for in identity proofing?
- Determining if an identity document has expired
- Verifying that a biometric sample comes from a live person and not a spoof (Correct answer)
- Confirming that a user's session is still active
- Detecting fraudulent activity in audit logs
Correct answer: Verifying that a biometric sample comes from a live person and not a spoof
Liveness detection is a technique used to prevent spoofing attacks by confirming that a biometric sample (e.g., a facial scan) is captured from a live, physically present person rather than a photo or video replay.
Question 5: In identity proofing, a 'breeder document' refers to which of the following?
- A document used to generate cryptographic keys
- A foundational identity document used to obtain other identity credentials (Correct answer)
- A document that proves organizational membership
- A secondary ID used only for low-assurance proofing
Correct answer: A foundational identity document used to obtain other identity credentials
A breeder document is a foundational document, such as a birth certificate or passport, that can be used to obtain other identity credentials like a driver's license or Social Security card.
Question 6: Which of the following best describes 'identity binding' in the enrollment process?
- Linking an authenticator or credential to a verified identity (Correct answer)
- Associating access permissions with a user role
- Encrypting a user's identity attributes at rest
- Federating an identity across multiple domains
Correct answer: Linking an authenticator or credential to a verified identity
Identity binding is the process of associating an authenticator (such as a hardware token or password) with a proofed identity, ensuring the credential is controlled by the rightful individual.
Question 7: Knowledge-Based Authentication (KBA) used during identity proofing is primarily intended to:
- Replace multi-factor authentication for high-assurance systems
- Verify that a claimant has knowledge of information associated with their identity (Correct answer)
- Encrypt knowledge factors for secure storage
- Generate one-time passwords for remote access
Correct answer: Verify that a claimant has knowledge of information associated with their identity
KBA leverages questions about information associated with an individual (e.g., previous addresses, financial records) to provide additional evidence that the claimant controls the identity they are asserting.
CIAM Identity Proofing and Verification 1
According to NIST SP 800-63A, which Identity Assurance Level (IAL) requires in-person or remote proofing with validation of a government-issued ID?