Identity and Access Management (IAM) Concepts NDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A file server contains project documents. The project manager, who owns the files, wants to grant read access to a specific team member. The company policy requires that only the file owner can set permissions. Which access control model is being used?

   • AAttribute-based access control (ABAC)
   • BDiscretionary access control (DAC)
   • CRole-based access control (RBAC)
   • DMandatory access control (MAC)
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company wants to allow its employees to use their existing corporate credentials to access a third-party SaaS application. The company does not want to store the employees' passwords in the SaaS application. Which technology best meets this requirement?

   • AA local user account in the SaaS application with the same password as the corporate account.
   • BFederated identity management using SAML-based single sign-on.
   • CA VPN connection to the corporate network, then direct access to the SaaS application.
   • DA shared password vault where employees retrieve the SaaS application's password.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company wants to implement MFA for all users, but some employees work in areas with no cellular or internet connectivity. They have company-issued laptops with TPM chips. Which MFA method would work in an offline environment?

   • ASmart card with a PIN.
   • BAuthenticator app that requires internet to sync.
   • CEmail-based verification codes.
   • DSMS-based one-time codes.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is implementing SSO for its employees. The security team is concerned about the risk of session hijacking. They want to implement a control that reduces the risk without significantly impacting user experience. Which control is most effective?

   • AUse longer session timeouts to reduce the number of login prompts.
   • BUse short session timeouts and require re-authentication for sensitive actions.
   • CDisable SSO and require users to log in to each application separately.
   • DUse the same session token for all applications to simplify management.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is evaluating SSO solutions. They have a mix of legacy on-premises applications that support only LDAP and modern cloud applications that support SAML. The company wants a single sign-on experience for all applications. Which solution should they choose?

   • AAn LDAP-only directory service.
   • BA SAML-only identity provider.
   • CAn identity provider that supports both LDAP and SAML protocols.
   • DA password manager that auto-fills credentials for all applications.
   Reveal Solution Discussion Select an answer first