A company has multiple internal web applications, each with its own login page. Employees complain about remembering many passwords, and the IT team wants to reduce password fatigue while maintaining central control over access. Which solution best addresses this need?

Use a hardware token for each application

Implement single sign-on (SSO) using a central identity provider

Deploy a password manager for each user

Set the same password for all applications

A network administrator is configuring a shared folder on a Windows server. The folder contains marketing materials that should be readable by all employees but only writable by the 'Marketing' group. The administrator needs to enforce this policy at the file-system level. What should the administrator configure?

A group policy that disables write access for all users

An access control list (ACL) with read permission for 'Everyone' and write permission for 'Marketing'

A shared folder permission that grants full control to 'Everyone'

An audit policy that logs all write attempts

Which of the following is an example of the 'something you have' authentication factor?

A personal identification number (PIN)

A one-time password generated by a hardware token

An organization wants to allow employees to use their corporate credentials to access a third-party SaaS application without creating a separate account. Which approach should the organization implement?

A shared password for all employees

Federated single sign-on (SSO) using SAML or OIDC

A local account on the SaaS application for each employee

A VPN connection to the SaaS provider

In network security, what is the correct sequence and definition of the three processes that occur when a user attempts to access a protected resource?

Authorization: user claims an identity; Identification: user proves the identity; Authentication: user is granted access rights

Identification: user claims an identity; Authentication: user proves the identity; Authorization: user is granted access rights

Authentication: user claims an identity; Identification: user proves the identity; Authorization: user is granted access rights

Identification: user proves an identity; Authentication: user claims the identity; Authorization: user is granted access rights

EC-CouncilCertified Security Specialist

Domain 1Objective 2

Identification, Authentication, and Authorization ECSS Practice Questions (Page 3)

Part of the Network Defense Fundamentals and Controls domain, which makes up ~21% of our current practice bank.

46questions here

10free pages

9concepts

9 Concepts in This Objective

Identification vs. Authentication vs. Authorization
Identification Methods
Authentication Factors
Authentication Mechanisms
Authorization Models
Access Control Lists (ACLs)
Single Sign-On (SSO)
Multi-Factor Authentication (MFA)
Identity and Access Management (IAM)

Questions 11–15

11application · medium
A company has multiple internal web applications, each with its own login page. Employees complain about remembering many passwords, and the IT team wants to reduce password fatigue while maintaining central control over access. Which solution best addresses this need?
Select an answer first
12application · medium
A network administrator is configuring a shared folder on a Windows server. The folder contains marketing materials that should be readable by all employees but only writable by the 'Marketing' group. The administrator needs to enforce this policy at the file-system level. What should the administrator configure?
Select an answer first
13foundation · easy
Which of the following is an example of the 'something you have' authentication factor?
Select an answer first
14application · medium
An organization wants to allow employees to use their corporate credentials to access a third-party SaaS application without creating a separate account. Which approach should the organization implement?
Select an answer first
15foundation · easy
In network security, what is the correct sequence and definition of the three processes that occur when a user attempts to access a protected resource?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.