5.2 - Design Identification and Authentication Strategy (e.g., People, Devices, and Services) CISSP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A small business has several administrators who manage different systems. They currently share passwords for administrative accounts, which creates a security risk. The business wants to eliminate password sharing while maintaining the ability to audit who accessed what. Which solution should they implement?

   • AUse the same password for all administrative accounts and change it monthly.
   • BCreate a single administrative account and distribute the password to all admins.
   • CStore administrative passwords in a shared spreadsheet that is protected by a single password.
   • DDeploy a password vault that stores administrative credentials, requires individual users to authenticate with MFA, and logs all access to the vault.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A cloud service provider wants to allow customers to access a support portal. They want to minimize the risk of standing privileges for support agents, but they also want to ensure that agents can access customer data only when a support ticket is assigned to them. Which approach best meets these requirements?

   • AImplement JIT provisioning that grants an agent temporary access to a customer's data when a ticket is assigned, and revokes it when the ticket is closed.
   • BUse a shared support account that has access to all customer data.
   • CRequire agents to request access manually each time, and an administrator approves it.
   • DGrant all support agents permanent access to all customer data.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is a primary benefit of password-less authentication over traditional password-based authentication?

   • AIt allows users to share accounts more easily
   • BIt eliminates the need for user identity verification
   • CIt reduces the risk of credential theft and phishing attacks
   • DIt requires no additional hardware or software
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is onboarding a new department of 50 employees. The IT team wants to grant them access to a shared file server, a project management tool, and a time-tracking system. They want to avoid configuring permissions for each employee individually. Which approach is most efficient and maintainable?

   • AAssign permissions to each employee individually in each system.
   • BUse a script to copy permissions from one employee to all others.
   • CCreate a department group, assign the necessary permissions to the group, and add all 50 employees to the group.
   • DCreate a shared account for the department and give all employees the password.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is implementing MFA for remote access to its network. They want to use a method that is resistant to phishing and does not require users to carry a separate physical token. Which method should they choose?

   • ASMS one-time passcodes.
   • BEmail-based one-time passcodes.
   • CPush-based authentication to a mobile app that requires the user to approve the login.
   • DFIDO2 security keys.
   Reveal Solution Discussion Select an answer first