CySA+ Test Identity and Access Management 1 — Questions and Answers
Question 1: Which IAM principle ensures that users are granted only the minimum permissions necessary to perform their job functions?
- Separation of duties
- Least privilege (Correct answer)
- Need to know
- Role rotation
Correct answer: Least privilege
The principle of least privilege limits user access rights to only what is strictly required for their role, reducing the attack surface if credentials are compromised.
Question 2: A security analyst notices that a terminated employee's account is still active in Active Directory two weeks after their departure. Which IAM process failed?
- Provisioning
- Authentication
- De-provisioning (off-boarding) (Correct answer)
- Role-based access review
Correct answer: De-provisioning (off-boarding)
De-provisioning is the process of removing access rights when an employee leaves; failure to perform this step leaves orphaned accounts that can be exploited.
Question 3: Which access control model assigns permissions based on an employee's job function or title within an organization?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC grants permissions based on predefined roles tied to job functions, making it easier to manage access at scale by assigning users to roles rather than individual permissions.
Question 4: An organization wants to allow employees to log in to multiple internal applications using a single set of credentials. Which technology best supports this requirement?
- Multi-Factor Authentication (MFA)
- Single Sign-On (SSO) (Correct answer)
- Public Key Infrastructure (PKI)
- Privileged Access Management (PAM)
Correct answer: Single Sign-On (SSO)
SSO allows users to authenticate once and gain access to multiple applications without re-entering credentials, improving usability while centralizing authentication control.
Question 5: Which protocol is most commonly used to enable federated identity management between organizations and cloud service providers?
- RADIUS
- LDAP
- SAML 2.0 (Correct answer)
- TACACS+
Correct answer: SAML 2.0
SAML 2.0 (Security Assertion Markup Language) is the industry-standard XML-based protocol for exchanging authentication and authorization data between identity providers and service providers.
Question 6: Which IAM concept requires that a single critical task be divided among multiple individuals so that no one person has complete control?
- Least privilege
- Need to know
- Separation of duties (Correct answer)
- Mandatory vacation
Correct answer: Separation of duties
Separation of duties splits sensitive tasks across multiple people to prevent fraud, errors, and abuse of privilege, ensuring no single individual can complete a high-risk process alone.
Question 7: A CySA+ analyst is reviewing an IAM report and finds several accounts that have not been used in 90 days. What should be the FIRST action taken?
- Immediately delete all inactive accounts
- Reset the passwords on all inactive accounts
- Disable the accounts pending review and notify account owners (Correct answer)
- Add the accounts to a high-privilege monitoring group
Correct answer: Disable the accounts pending review and notify account owners
Disabling (rather than immediately deleting) inactive accounts pending review follows proper IAM hygiene — it prevents unauthorized use while allowing time to verify the accounts are truly abandoned before permanent removal.
CySA+ Test Identity and Access Management 1
Which IAM principle ensures that users are granted only the minimum permissions necessary to perform their job functions?