5.2 - Design Identification and Authentication Strategy (e.g., People, Devices, and Services) CISSP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is implementing SSO for its employees. They want to ensure that when an employee leaves the company, their access to all applications is revoked immediately. Which approach best supports this requirement?

   • AUse a centralized identity provider and integrate it with the HR system to disable the user's account upon termination.
   • BSet the user's password to expire at the end of the month.
   • CRely on the user's session to expire naturally.
   • DManually remove the user from each application's user list.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A university wants to allow students to access the library system, email, and learning management system with a single login. The systems are maintained by different departments and use different authentication mechanisms. The university also wants to ensure that when a student graduates, their access to all systems is revoked quickly. Which approach best meets these requirements?

   • AAllow students to use their social media accounts to log in to all systems.
   • BCreate separate accounts in each system and synchronize passwords using a password manager.
   • CImplement a centralized identity provider that supports SAML-based SSO and integrates with the student information system to automatically disable accounts upon graduation.
   • DUse a shared LDAP directory but require users to authenticate separately to each system.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common password-less authentication method?

   • ABiometric verification (e.g., fingerprint or facial recognition)
   • BA one-time password (OTP) sent via SMS
   • CA security question
   • DA complex password with special characters
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A bank is launching a new online banking platform. They need to verify the identity of new customers remotely. The bank wants to comply with KYC regulations and prevent fraud, but they also want to minimize friction for legitimate customers. Which identity proofing approach best balances these requirements?

   • ARequire customers to visit a branch to verify their identity in person.
   • BRequire customers to upload a government-issued ID and a selfie, and use automated facial recognition to match them.
   • CUse a knowledge-based verification (KBV) process that asks questions based on credit report data, then issue a credential that requires MFA.
   • DAllow customers to open an account with just an email address and a password.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is implementing SSO for its employees across multiple SaaS applications. They want to use OpenID Connect (OIDC) for modern applications and SAML for legacy applications. The security team wants to ensure that MFA is enforced for all users. Which approach best achieves this?

   • AUse SAML for all applications and rely on the application to enforce MFA.
   • BConfigure the identity provider to require MFA at authentication and use OIDC for modern apps and SAML for legacy apps, both relying on the same identity provider session.
   • CUse only OIDC for all applications and require MFA at the application level.
   • DImplement MFA separately in each application, regardless of the SSO protocol.
   Reveal Solution Discussion Select an answer first