5.2 - Design Identification and Authentication Strategy (e.g., People, Devices, and Services) CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company wants to improve the security of its service accounts that are used by applications to access databases. The accounts have high privileges and are rarely changed. Which solution would best reduce the risk of these credentials being compromised?

   • AHardcode the credentials in the application configuration files.
   • BUse the same service account for all applications to reduce the number of credentials.
   • CSet the service account passwords to never expire.
   • DStore the service account credentials in a privileged access management (PAM) solution that rotates the passwords automatically and requires check-out with MFA.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In the AAA framework, what is the primary function of the accounting component?

   • ATo encrypt data transmitted between the user and the system
   • BTo determine which resources a user can access
   • CTo record and log user activities for auditing and billing purposes
   • DTo verify the user's identity using passwords or biometrics
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of using groups and roles in an identity and access management (IAM) system?

   • ATo enforce stronger password policies for all users in the organization
   • BTo track individual user activity for auditing purposes
   • CTo assign permissions to collections of users rather than to each individual user
   • DTo encrypt data stored in the organization's databases
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A government agency is rolling out a new citizen portal that requires identity proofing before issuing credentials. They must comply with NIST 800-63A identity assurance level 2 (IAL2), which requires remote identity proofing with verification of identity attributes. The agency wants to minimize fraud but also wants to avoid requiring citizens to visit a physical office. Which approach best meets the compliance requirement?

   • AAllow citizens to self-assert their identity by entering their name and date of birth, then issue a credential immediately.
   • BUse a remote identity proofing service that verifies government-issued ID documents and matches the applicant's face to the ID photo, then issue a credential that requires MFA.
   • CIssue a credential based on a utility bill and a social media account.
   • DRequire citizens to visit a physical office to present their ID in person.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is deploying a new VPN for remote employees. They want to ensure that only authorized users can connect, that they are granted access only to the network segments they need, and that all connection attempts are logged. Which protocol should they use?

   • AKerberos, which provides ticket-based authentication within a domain.
   • BLDAP, which is used for directory services and can authenticate users but does not provide accounting.
   • CTACACS+, which separates authentication, authorization, and accounting functions.
   • DRADIUS, which provides authentication, authorization based on group membership, and accounting logs.
   Reveal Solution Discussion Select an answer first