A security architect is evaluating biometric systems for a high-security facility. The requirement is to minimize the chance of an unauthorized person being granted access, even if it means some authorized users may be inconvenienced by having to retry. Which metric should the architect prioritize?

High crossover error rate (CER)

Low false acceptance rate (FAR)

Which practice is recommended for securely storing passwords?

Encrypting them with a reversible algorithm

Storing them in plaintext in a database

Hashing them with a strong, salted hash function

Using a simple hash without salt

Which of the following is an example of a software token?

An authenticator app on a smartphone

An organization wants to authenticate users accessing an internal web application using smart cards. The smart card contains a private key and a digital certificate. What must the application verify to authenticate the user?

The certificate's public key matches the user's username in the directory

The certificate is signed by a trusted CA and the user proves possession of the private key

The certificate is stored on the smart card and the user's password matches the certificate

The certificate has not expired and the user knows a PIN

Certified Information Systems Security Professional

Domain 5Objective 6

5.6 - Implement Authentication Systems CISSP Practice Questions (Page 3)

Part of the Identity and Access Management (IAM) domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

11concepts

13%of the exam

Questions 11–15

11application · medium
A security architect is evaluating biometric systems for a high-security facility. The requirement is to minimize the chance of an unauthorized person being granted access, even if it means some authorized users may be inconvenienced by having to retry. Which metric should the architect prioritize?
Select an answer first
12foundation · easy
Which practice is recommended for securely storing passwords?
Select an answer first
13foundation · easy
Which of the following is an example of a software token?
Select an answer first
14foundation · easy
Which standard is commonly used for federated identity management to exchange authentication and authorization data?
Select an answer first
15application · medium
An organization wants to authenticate users accessing an internal web application using smart cards. The smart card contains a private key and a digital certificate. What must the application verify to authenticate the user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.