5.2 - Design Identification and Authentication Strategy (e.g., People, Devices, and Services) CISSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A financial trading firm has a web application that handles sensitive transactions. They want to enforce a session timeout after 10 minutes of inactivity, but traders often leave their desks for longer periods. The security team is concerned about session hijacking. Which combination of controls would best balance security and usability?

   • ASet a session timeout of 5 minutes for all users.
   • BSet a session timeout of 60 minutes with no re-authentication requirement.
   • CSet an absolute session timeout of 30 minutes and require re-authentication with MFA after any period of inactivity longer than 10 minutes.
   • DDisable session timeouts entirely and rely on IP-based restrictions.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the purpose of identity proofing during the registration process?

   • ATo verify that the claimed identity attributes belong to the person requesting access
   • BTo assign a unique username to the user
   • CTo create a session for the user
   • DTo encrypt the user's password
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A financial services firm is migrating to a cloud-based platform. The security team wants to reduce standing privileges for contractors who need temporary access to a project management tool. They also need to ensure that when a contractor's contract ends, their access is automatically revoked. The firm has an existing HR system that triggers workflows on employee status changes. Which solution best meets these requirements?

   • ACreate permanent accounts for contractors and manually remove them when the contract ends.
   • BImplement Just-In-Time (JIT) provisioning that creates a temporary account when the contractor authenticates via the identity provider, assigns them to a project-specific role, and deprovisions the account when the HR system signals contract termination.
   • CUse a shared generic account for all contractors and change the password monthly.
   • DConfigure the project management tool to allow self-registration with a corporate email address.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which component of the AAA framework is responsible for verifying the identity of a user or device?

   • AAuthorization
   • BAuthentication
   • CAuditing
   • DAccounting
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does Single Sign-On (SSO) typically work?

   • AThe user must enter their password for each application, but the system remembers it
   • BThe user's biometric data is stored on every application server
   • CThe user's password is sent to each application for verification
   • DThe user authenticates once to an identity provider, which then provides tokens or assertions to other applications
   Reveal Solution Discussion Select an answer first