CSS CSS Identity & Access Management 1 — Questions and Answers
Question 1: What is the principle of least privilege in identity and access management?
- Users are granted only the minimum permissions necessary to perform their job functions (Correct answer)
- All users share a common administrator account
- Access is granted by default and revoked when abused
- Privileged accounts are never used for daily tasks
Correct answer: Users are granted only the minimum permissions necessary to perform their job functions
Least privilege limits the blast radius of a compromised account by ensuring users can only access what they need for their specific role.
Question 2: What does multi-factor authentication (MFA) require beyond a username and password?
- At least one additional verification factor such as a token, biometric, or push notification (Correct answer)
- A second username and password combination
- An additional security question only
- A hardware firewall device
Correct answer: At least one additional verification factor such as a token, biometric, or push notification
MFA combines something you know (password) with something you have (token) or something you are (biometric) to reduce account takeover risk.
Question 3: Which access control model grants permissions based on a user's job role rather than individual identity?
- Role-Based Access Control (RBAC) (Correct answer)
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC assigns permissions to roles, and users are granted access by being assigned to appropriate roles, simplifying administration at scale.
Question 4: What is credential stuffing and how does it differ from brute-force attacks?
- Credential stuffing uses stolen username/password pairs from breaches, while brute-force tries all possible combinations (Correct answer)
- Credential stuffing is slower than brute force
- Brute force uses breached credentials; credential stuffing generates random passwords
- Both attacks use the same technique
Correct answer: Credential stuffing uses stolen username/password pairs from breaches, while brute-force tries all possible combinations
Credential stuffing relies on real credentials from previous data breaches, making it more effective than random brute-force guessing.
Question 5: What is the purpose of a privileged access workstation (PAW)?
- A hardened, dedicated workstation used exclusively for privileged administrative tasks (Correct answer)
- A shared workstation for general office use
- A virtual machine for testing malware
- A remote desktop server for multiple users
Correct answer: A hardened, dedicated workstation used exclusively for privileged administrative tasks
A PAW is a dedicated, highly secured device used only for admin tasks, reducing exposure to phishing and malware that could compromise privileged credentials.
Question 6: What does single sign-on (SSO) provide to enterprise users?
- Access to multiple applications using one set of credentials authenticated once (Correct answer)
- A single password shared across all users
- Elimination of all password requirements
- Automatic privilege escalation for all users
Correct answer: Access to multiple applications using one set of credentials authenticated once
SSO allows users to authenticate once with an identity provider and gain access to multiple connected applications without re-entering credentials.
CSS CSS Identity & Access Management 1
What is the principle of least privilege in identity and access management?