Identity and Access Management (IAM) GISP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is implementing single sign-on (SSO) for its employees across multiple SaaS applications. The security team requires that the SSO solution support multi-factor authentication (MFA) and provide detailed audit logs of who accessed which application and when. The company also wants to minimize the number of times users have to enter their credentials. Which approach best meets these requirements?

   • AImplement a separate username and password for each SaaS application and require MFA for each application individually.
   • BDeploy a reverse proxy that intercepts all application traffic and injects a session cookie after the user authenticates once.
   • CUse a password manager to store all application passwords and auto-fill them, with MFA on the password manager itself.
   • DUse a federated identity provider (IdP) that supports SAML or OIDC, with MFA enforced at the IdP and centralized logging of authentication events.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A financial institution is required to enforce separation of duties (SoD) in its trading system. The system currently uses role-based access control (RBAC), but the compliance team has found that some users have conflicting roles that allow them to both enter and approve trades. The institution wants to automate the detection and prevention of such conflicts. Which approach is most effective?

   • AManually review all role assignments on a quarterly basis and remove any conflicting roles found.
   • BCreate a single 'supervisor' role that includes both trade entry and approval, and assign it only to senior staff.
   • CImplement a SoD enforcement engine that analyzes role assignments and prevents users from being assigned conflicting roles, with periodic recertification.
   • DRely on the RBAC system's built-in role hierarchy to prevent conflicts.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is implementing multi-factor authentication (MFA) for all remote access to its corporate network. The security team is concerned about phishing attacks that can bypass SMS-based MFA. They also want to ensure that the MFA solution is user-friendly and does not require additional hardware for all employees. Which MFA method best addresses the phishing concern while balancing usability?

   • AUse hardware security keys (e.g., YubiKey) for all employees, because they are the most phishing-resistant.
   • BUse email-based OTP, because it is easy to implement and does not require additional hardware.
   • CUse SMS-based one-time passcodes (OTP), because they are widely supported and easy to use.
   • DUse a mobile authenticator app with push notifications and number matching, which provides a higher level of security than SMS and is user-friendly.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is implementing a new financial system and wants to ensure that no single employee can both create a vendor and approve a payment to that vendor. Which IAM governance principle is being enforced?

   • AMandatory access control (MAC), which uses security labels to enforce access decisions.
   • BSeparation of duties (SoD), which requires that critical tasks be divided among multiple individuals to prevent fraud and errors.
   • CLeast privilege, which grants users only the minimum permissions needed to perform their job.
   • DJob rotation, which requires employees to periodically switch roles to reduce the risk of fraud.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A database administrator needs to grant a reporting analyst the ability to run SELECT queries on a specific table, but the analyst should not be able to modify the table structure or data. Which SQL command should the administrator use?

   • AGRANT EXECUTE ON table_name TO analyst;
   • BGRANT ALL PRIVILEGES ON table_name TO analyst;
   • CGRANT SELECT ON table_name TO analyst;
   • DGRANT INSERT, UPDATE, DELETE ON table_name TO analyst;
   Reveal Solution Discussion Select an answer first