Identity and Access Management

Question 1 of 6

An employee transfers from the Finance department to the HR department. Their Finance access is never removed, and six months later they also receive IT department access for a project. They now have access to Finance, HR, and IT resources. What IAM problem does this represent, and what is the formal term?

Identity proofing failure — the employee's identity was never properly validated when they joined Finance Access creep (also called privilege creep) — the accumulation of permissions from multiple roles over time without removing previous role access during lifecycle transitions Orphaned account — the Finance account was never disabled after the employee left the Finance department Provisioning error — the HR system incorrectly assigned Finance permissions when creating the employee's HR account

Question 2 of 6

An organization's HR department verifies a new hire's identity by collecting their name and employee ID, checking their government-issued ID against a government database to confirm it is genuine and belongs to this person, and having the HR manager formally document that identity verification was completed. These three steps correspond to which identity proofing stages?

Authentication, authorization, and accounting — the three AAA steps of identity verification Resolution, validation, and attestation — collecting uniquely identifying information, verifying its genuineness, and having a qualified party formally confirm the verification Provisioning, deprovisioning, and auditing — creating the account, planning for future removal, and logging the process Identification, authentication, and authorization — the standard access control sequence applied to identity proofing

Question 3 of 6

A user logs into the corporate SSO portal at 8 AM. At 9 PM that evening, after 13 hours of activity across multiple connected applications, the user is suddenly prompted to re-enter their full credentials. No policy violation occurred and no security event triggered the prompt. What is the MOST likely explanation?

The SSO system detected unusual activity and triggered a re-authentication challenge as a security precaution The user's network IP address changed, invalidating the SSO session because it is tied to the originating IP address The SSO session reached its maximum lifetime (typically 24 hours), and the user re-authenticated at 8 AM; 13 hours into a 24-hour session would not cause expiration. However, if the session was set to 12 hours, the session timer expired after the configured duration The SSO session timer expired — SSO sessions have a maximum lifetime (typically 24 hours) after which users must re-authenticate regardless of activity, limiting the exposure window of any captured session token

Question 4 of 6

A directory administrator needs to locate a user object in the LDAP directory. The user is named Alice Chen, in the Marketing Organizational Unit, at Globex Corporation, in the United States. What type of LDAP identifier uniquely specifies this user's full location in the directory tree?

Common Name (CN) — CN=Alice Chen uniquely identifies the user across the entire directory Distinguished Name (DN) — a full path through the DIT hierarchy specifying all container objects and the leaf object: CN=Alice Chen,OU=Marketing,O=Globex Corporation,C=US Organizational Unit (OU) — OU=Marketing uniquely identifies all users in the Marketing group Relative Distinguished Name (RDN) — CN=Alice Chen combined with the domain name uniquely locates the user globally

Question 5 of 6

A development team wants to implement a “Log in with Google” feature in their mobile application. After logging in, the app needs to know the user's identity (who they are) to personalize the experience. Which protocol provides identity verification, and why is SAML NOT the appropriate choice?

SAML — it is the standard protocol for both web and mobile federated authentication and provides identity assertions that mobile apps can process natively OAuth 2.0 — it provides complete identity verification through its access token mechanism and is fully supported by all mobile platforms OpenID Connect (built on OAuth 2.0) — it provides an ID token confirming who the user is; SAML is not appropriate for mobile because it relies on browser redirects with XML assertions, while native mobile apps use OAuth-based flows with JSON tokens LDAP — the mobile app should connect directly to Google's LDAP directory service to retrieve the user's identity attributes

Question 6 of 6

A university allows students to access research databases at ten partner universities using only their home university credentials. No separate accounts are created at the partner universities. What IAM concept enables this, and what establishes the trust between institutions?

SSO — the student's SSO session from the home university is extended across all ten partner universities using the same session token Federation — trust relationships between institutional identity providers allow the student's home IdP credentials to be accepted at partner institutions without requiring duplicate accounts LDAP replication — the home university's directory is replicated to all ten partner universities so the student's account exists locally at each institution OAuth delegation — the home university grants the student an OAuth token that can be presented to all partner universities for resource access

Matching

Match each description to the correct IAM concept.

1. An XML-based protocol for exchanging authentication assertions between an Identity Provider and a Service Provider; not designed for mobile applications because it relies on browser redirects

2. An authorization framework that grants third-party applications access to user resources without exposing credentials; does NOT itself perform authentication or verify who the user is

3. An identity layer built on top of an authorization framework that adds an ID token confirming the user's identity; used for SSO and federated login with mobile support

4. A directory access protocol based on the X.500 standard; uses container objects (country, org, OU) and leaf objects (users, computers) organized in a Directory Information Tree

1. 2. 3. 4.

A. SAML

B. OAuth 2.0

C. OpenID Connect

D. LDAP

Identity and Access Management — Quiz

Matching