5.2 - Design Identification and Authentication Strategy (e.g., People, Devices, and Services) CISSP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which action is part of secure session management?

   • AUsing a predictable session ID pattern
   • BAllowing sessions to remain active indefinitely
   • CKeeping session tokens in the URL for easy access
   • DInvalidating the session token upon user logout
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary benefit of Single Sign-On (SSO) for users?

   • AUsers get a new password for each system
   • BUsers no longer need to remember any passwords
   • CUsers can share their credentials with others
   • DUsers authenticate once and gain access to multiple systems without re-authenticating
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is deploying a new internal application that requires users to authenticate, then be granted access based on their department, and finally have their actions logged for audit. The application currently uses a local database for user accounts. The security team wants to centralize this process. Which technology should they implement?

   • AA password vault that stores all user passwords and automatically fills them into the application.
   • BA session management system that tracks user sessions and expires them after a timeout.
   • CA single sign-on portal that authenticates users once and grants access to all applications.
   • DA RADIUS server that authenticates users, applies group-based authorization policies, and sends accounting records to a central log server.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company wants to reduce the risk of phishing attacks that target passwords. They are considering implementing password-less authentication using FIDO2 security keys. The security team wants to ensure that the solution is resistant to phishing and provides a good user experience. Which implementation should they choose?

   • AUse a biometric login on the device that does not require a network connection.
   • BUse a mobile app that receives a one-time passcode via SMS.
   • CImplement a password manager that autofills passwords on the correct website.
   • DDeploy FIDO2 security keys that require a user gesture (e.g., touch) and are bound to the specific website's origin.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of a password vault?

   • ATo generate random passwords for users
   • BTo share passwords with anyone without restrictions
   • CTo authenticate users without any password
   • DTo securely store and manage credentials for multiple accounts
   Reveal Solution Discussion Select an answer first