A company is migrating from a legacy NTLM-based authentication to Kerberos. They have a mix of Windows and Linux servers. The architect must ensure that service tickets are issued securely and that the KDC is protected. Which design consideration is most critical?

Disable all other authentication protocols to force Kerberos

Configure SAML as the authentication protocol for all services

Use RADIUS to proxy Kerberos tickets to Linux servers

Ensure the KDC is highly available and that all clients and services are registered in the directory with proper SPNs

Which of the following is a common use of LDAP in authentication?

Providing risk-based authentication

Validating a user's credentials against a directory

A startup wants to provide quick access to a low-risk internal wiki for employees. They want minimal friction and are willing to accept a lower security posture for this non-sensitive resource. Which authentication approach is most appropriate?

Federated authentication with a third-party identity provider

Multi-factor authentication with a biometric factor

Risk-based elevation that requires MFA only for certain IP ranges

Single-factor authentication using a corporate username and password

A university is deploying a new Wi-Fi network that uses RADIUS for authentication. They want to support both students (using their existing LDAP credentials) and guest users (who need a temporary account). The RADIUS server must also log accounting data for compliance. Which design best meets these requirements?

Use SAML for Wi-Fi authentication and RADIUS for accounting

Configure RADIUS to authenticate students against LDAP and maintain a separate guest database within RADIUS, with accounting enabled for all sessions

Implement Kerberos for Wi-Fi authentication and use syslog for accounting

Use LDAP for both students and guests, creating a temporary LDAP account for each guest

Information Systems Security Architecture Professional

Domain 4Objective 2

4.2 Architect Identity Authentication ISSAP Practice Questions (Page 5)

Part of the Identity and Access Management (IAM) Architecture domain, which accounts for 25% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 5–8 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

13concepts

25%of the exam

Questions 21–25

21expert · hard
A company is migrating from a legacy NTLM-based authentication to Kerberos. They have a mix of Windows and Linux servers. The architect must ensure that service tickets are issued securely and that the KDC is protected. Which design consideration is most critical?
Select an answer first
22foundation · easy
Which of the following is a common use of LDAP in authentication?
Select an answer first
23application · medium
A healthcare organization needs to enforce fine-grained access control policies for electronic health records, based on attributes such as the user's role, the patient's consent, and the time of day. The policies must be centralized and evaluated at runtime. Which technology should the architect choose?
Select an answer first
24application · easy
A startup wants to provide quick access to a low-risk internal wiki for employees. They want minimal friction and are willing to accept a lower security posture for this non-sensitive resource. Which authentication approach is most appropriate?
Select an answer first
25expert · hard
A university is deploying a new Wi-Fi network that uses RADIUS for authentication. They want to support both students (using their existing LDAP credentials) and guest users (who need a temporary account). The RADIUS server must also log accounting data for compliance. Which design best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

4.2 Architect Identity Authentication ISSAP Practice Questions (Page 5)

Questions 21–25

A company is migrating from a legacy NTLM-based authentication to Kerberos. They have a mix of Windows and Linux servers. The architect must ensure that service tickets are issued securely and that the KDC is protected. Which design consideration is most critical?

Which of the following is a common use of LDAP in authentication?

A startup wants to provide quick access to a low-risk internal wiki for employees. They want minimal friction and are willing to accept a lower security posture for this non-sensitive resource. Which authentication approach is most appropriate?

Keep studying — Identity and Access Management (IAM) Architecture