Domain 5. Identity and Access Management (IAM)

Question 1

Is the collection of mechanisms that work together to protect the assets of an organization and, at the same time, allow controlled access to authorized subjects.

Answer 1

Access Control

Question 2

Restricting a user’s KNOWLEDGE (access to data) to only the data required for them to perform their role.

Restricting access to only required personnel who require access.

Answer 2

Need to Know

Question 3

Restricting a user’s ACTIONS/PRIVILEGES to only those required for them to perform their role.

Granting only the minimum permissions required by the user or system.

Answer 3

Least Privilege

Question 4

A collection of users that has been named. The users are generally not associated with a specific job in the organization. Instead, they could be part of a specific internal leadership team or focus area.

Answer 4

Groups

Question 5

A set of permissions that is usually associated with a specific job within an organization, such as a call center agent.

Answer 5

Roles

Question 6

The assertion of a user’s identity or a process to a system.

Answer 6

Identification

Question 7

The verification of an identity through knowledge, ownership, or characteristic.

Answer 7

Authentication

Question 8

The level of access defined for the identified and authenticated user or process.

Answer 8

Authorization

Question 9

Refers to proper identification, authentication, authorization that is logged and monitored. Also known as the Principle of Access Control.

Answer 9

Accountability

Question 10

This is when a valid user is falsely rejected by the system. The false rejection rate (FRR) is the probability that a valid user will be rejected by the system. It is expressed as a percentage.

Answer 10

Type 1 (False Rejection)

Question 11

This is when an invalid user is given access to a system. It is a much more serious and potentially dangerous situation. The false acceptance rate (FAR) is the probability that an invalid user will be accepted by the system. It is expressed as a percentage.

Answer 11

Type 2 (False Acceptance)

Question 12

The intersection of the two error plots (FAR and FRR)

Answer 12

Crossover Error Rate (CER)

Question 13

Refers to management of sessions created through a successful user identification, authentication, and authorization process.

Answer 13

Session management

Question 14

Best way to prevent or mitigate session hijacking

Answer 14

Session termination and re-authentication

Question 15

Refer to the strength of authentication processes and systems.

Answer 15

Authenticator Assurance Levels (AAL)

Question 16

FIM trust relationships include three components:

Answer 16

Principal/user, identity provider, relying party

Question 17

The person who wants to log in or access the system.

Answer 17

Principal/User

Question 18

The entity that owns the identity and performs the authentication

Answer 18

Identity Provider

Question 19

Also known as the service provider

Answer 19

Relying party

Question 20

Frequently used in Federated Identity Management (FIM) solutions and provides authentication and authorization.

Answer 20

SAML

Question 21

Are written in a language called XML, or Extensible Markup Language. XML is a way of communicating in a manner that is machine and human-readable.

Answer 21

SAML assertions

Question 22

(like SAML) offers authentication and authorization functionality. Like most federated access standards, the primary goal is enabling identity federation authentication and authorization. It was created by a consortium of companies, including IBM, Microsoft, and Verisign, and it was codified as a standard by OASIS.

Answer 22

WS-Federation

Question 23

Provides the AUTHENTICATION component.

allows a user to use an existing account to identify and authenticate to multiple disparate resources—websites, systems, and so on—without the need to create new passwords for each resource. With __ a user password is given only to the user’s identity provider—Microsoft, for example—and the identity provider confirms the user’s identity to sites the user visits.

Answer 23

OpenID

Question 24

Provides the AUTHORIZATION component to a federated access solution.

Is the protocol or standard that allows users to gain access—to be authorized—to resources.

Answer 24

OAuth

Question 25

SAML's Key Components:

Answer 25

1. Assertion: authentication, authorization, and other attributes. 2. Protocol: defines how entities request and respond to requests. 3. Bindings: mapping of SAML onto standard communication protocols (ex: HTTP). 4. Profiles: define how SAML can be used for different business use cases (ex: Web SSO, LDAP, etc.)

Question 26

Two key characteristics of SAML:

Answer 26

1. SAML uses assertion tokens. 2. Assertions are written in a language called Extensible Markup Language (XML), which is a way of communicating in a manner that is machine and human-readable.

Question 27

Enforcing access control policies within an organization to regulate and manage user access

Answer 27

Access Policy Enforcement

Question 28

Responsible for making access control decisions based on predefined access policies and rules (evaluate access requests)

Answer 28

Policy decision point (PDP)

Question 29

Responsible for enforcing the access control decisions made by the PDP (acts as a gatekeeper)

Answer 29

Policy enforcement point (PEP)

Question 30

Is an identity layer built on top of the OAuth 2.0 framework. It allows third-party applications to verify the identity of the end user and to obtain basic user profile information. While OAuth 2.0 is about resource access and sharing, __ is about user authentication.

Answer 30

OpenID Connect (OIDC)