4.2 Architect Identity Authentication ISSAP Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A financial services firm wants to reduce friction for routine internal application access while ensuring that high-risk actions (e.g., wire transfers above a threshold) require additional verification. They currently use a single sign-on solution that supports contextual signals such as device health, location, and user behavior. Which authentication approach best meets these requirements?

   • ARequire multi-factor authentication for all users on every access attempt
   • BUse single-factor authentication for all access and rely on post-authentication monitoring
   • CImplement risk-based elevation that prompts for an additional factor only when risk indicators exceed a threshold
   • DDeploy a hardware token for every user and require it for all logins
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An organization wants to implement attribute-based access control (ABAC) for a document management system. They need to enforce policies that consider user attributes, document classification, and environmental conditions. They also want to centralize policy management and audit decisions. Which architecture should be used?

   • AImplement access control lists (ACLs) on each document
   • BEmbed authorization logic in each application
   • CDeploy a XACML-based policy decision point (PDP) that evaluates policies against attributes from a policy information point (PIP) and logs decisions
   • DUse LDAP groups to manage access
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of OAuth?

   • ATo authenticate users with passwords
   • BTo encrypt data at rest
   • CTo provide delegated authorization for accessing resources
   • DTo provide a directory service
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A global company wants to implement risk-based authentication for its customer portal. They have a requirement to minimize false rejections for legitimate users, but also to block account takeover attempts. They plan to use IP reputation, device fingerprint, and behavioral analytics. Which approach best balances these requirements?

   • AUse a continuous risk score that combines multiple signals and triggers step-up authentication only when the score exceeds a dynamically adjusted threshold
   • BUse a simple rule that triggers MFA only when the device fingerprint is unknown
   • CBlock any login attempt from an IP address with a poor reputation
   • DRequire MFA for all logins regardless of risk
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary purpose of risk-based elevation in authentication?

   • ATo replace passwords with biometrics
   • BTo dynamically increase authentication requirements when risk is detected
   • CTo eliminate authentication for low-risk users
   • DTo require the same authentication strength for all users
   Reveal Solution Discussion Select an answer first