Identity and Access Management (IAM) GISP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   Your company uses Okta for SSO. You need to integrate a new SaaS application that supports only SAML 2.0. What must you configure in Okta to enable SSO for this application?

   • AAn OpenID Connect client configuration with the application's redirect URI
   • BAn OAuth 2.0 client ID and secret for the application
   • CA custom LDAP directory sync to the application
   • DA SAML application integration with the application's metadata, including the ACS URL and audience URI
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which practice is specifically designed to reduce the risk associated with privileged accounts?

   • ADisabling logging on privileged accounts
   • BUsing the same password for all privileged accounts
   • CRegularly rotating privileged account passwords
   • DSharing privileged credentials among administrators
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An employee is leaving the company. The security team wants to ensure that the employee's access is removed promptly, but also needs to preserve audit logs and any data owned by the employee for legal hold. Which deprovisioning process best satisfies these requirements?

   • ADisable the account immediately, revoke all active sessions, and retain the account in a disabled state with logs and data preserved.
   • BDelete the account immediately and transfer all files to the manager; logs are automatically retained by the system.
   • CChange the password to a random value and leave the account active for 30 days to allow for a smooth transition.
   • DRevoke only the employee's access to sensitive systems, but keep email and collaboration tools active for forwarding.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization must ensure that terminated employees lose access to all systems within 24 hours. Which combination of practices is most effective?

   • AManual deprovisioning by each system administrator
   • BAutomated deprovisioning integrated with HR systems and periodic access reviews
   • CChanging the user's password and keeping the account active for a week
   • DDisabling the account in Active Directory only
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company wants to allow its customers to sign in to its mobile app using their Google accounts. The app needs to access the customer's basic profile information (name and email) but should not receive the Google password. Which protocol is the most appropriate for this authentication and basic profile access?

   • ASecurity Assertion Markup Language (SAML), because it is a mature standard for exchanging authentication data.
   • BOAuth 2.0 alone, because it is an authorization framework that can provide access tokens.
   • COpenID Connect (OIDC), because it is an identity layer built on OAuth 2.0 that provides an ID token containing user profile claims.
   • DLightweight Directory Access Protocol (LDAP), because it can authenticate users against a directory.
   Reveal Solution Discussion Select an answer first