Identity and Access Management — CISSP Practice Questions

What is the most critical step in the identity lifecycle management process to prevent unauthorized access after an employee leaves the organization?

• A.A. Provisioning access to resources
• B.B. Assigning roles and responsibilities
• C.C. De-provisioning access upon termination
• D.D. Conducting regular access reviews

Why: De-provision access to prevent unauthorized access after employee termination De-provisioning access upon termination is critical to prevent unauthorized access to sensitive resources.

What initial step should be taken to ensure the technical compatibility and functionality of a third-party identity service with existing systems?

• A.Develop a comprehensive testing plan to validate integration
• B.Conduct a thorough review of the provider's documentation and APIs
• C.Configure the identity service to use existing user directories
• D.Train IT staff on the new identity service before integration

Why: Review provider documentation before integrating identity services Conducting a thorough review of the provider's documentation and APIs is essential to understand the integration requirements and ensure a smooth integration process.

What should be done to control access to a new database?

• A.A. Create a new user group for employees with similar database access needs
• B.B. Grant database administrators access to only the database features they require
• C.C. Implement a database access control system based on user roles
• D.D. Restrict database access to only those employees who have a legitimate need to access it

Why: Identify the best approach to controlling database access Implementing a database access control system based on user roles ensures that access is granted based on the principle of least privilege, reducing the risk of unauthorized access

When integrating a third-party identity service to access sensitive customer data, what should be done to ensure that access is properly restricted?

• A.A. Implement a combination of role-based access control (RBAC) and attribute-based access control (ABAC) using the third-party provider's roles and customer attributes
• B.B. Use attribute-based access control (ABAC) to restrict access to sensitive customer data based on customer attributes
• C.C. Configure the third-party provider to use an additional access control mechanism for sensitive customer data
• D.D. Rely on the third-party provider's default access control mechanisms

Why: Understand the importance of attribute-based access control in restricting access to sensitive data Using attribute-based access control (ABAC) ensures that access to sensitive data is properly restricted based on user attributes and environmental factors.

Your organization is implementing a new identity and access management system across all its global operations, including cloud services and on-premise infrastructure. What should be the first step to effectively manage the identification and authentication of people and devices?

• A.Conduct a thorough risk assessment to identify potential vulnerabilities in the current infrastructure and processes
• B.Develop a comprehensive authentication policy that aligns with industry standards and best practices
• C.Establish a centralized identity repository to streamline user and device management
• D.Define roles and responsibilities for identity management across different departments and teams

Why: Conduct risk assessments to identify vulnerabilities in identity management systems Conducting a thorough risk assessment is crucial to identify potential vulnerabilities and threats to the identity management system, allowing for proactive measures to be taken to mitigate them.

As the CISO of a company with a hybrid IaaS cloud environment, where some infrastructure is on-premise and some is cloud-based, what is the BEST approach to managing identification and authentication of people/devices across both environments?

• A.A. Implementing a unified identity management solution that can handle both on-premise and cloud-based infrastructure, using protocols such as SAML or OAuth
• B.B. Using separate identity management solutions for on-premise and cloud-based infrastructure, with manual synchronization of user identities
• C.C. Relying on the cloud provider's built-in identity management for cloud-based infrastructure and a separate on-premise solution, without integration between them
• D.D. Not using an identity management solution, relying on individual application authentication for each on-premise and cloud-based system

Why: Use cloud-based identity management solutions that integrate with on-premise systems Using a cloud-based identity management solution that integrates with on-premise systems provides a unified and consistent approach to identity management, simplifying administration and improving security.

As the CISO of a company, you are tasked with overseeing the integration of a third-party identity service that will handle customer personally identifiable information (PII). What is the BEST approach to ensuring the security and compliance of this sensitive data during the integration process?

• A.A. Conduct a thorough risk assessment and due diligence on the third-party identity service to ensure it meets your company's security and compliance standards
• B.B. Implement a hybrid approach with on-premises and cloud-based identity services without evaluating the specific security benefits for PII
• C.C. Select a third-party identity service based solely on its cost-effectiveness without considering security and compliance
• D.D. Develop a custom identity service with in-house security controls, assuming this will inherently provide better security for PII

Why: Ensure the security of sensitive data during the integration of third-party identity services Using a third-party identity service with a proven track record of security and compliance is the best approach, as it provides a secure and reliable solution for managing sensitive data.

As the CISO of a company, you are tasked with integrating a cloud-based third-party identity service to provide identity and access management (IAM) capabilities. What is the BEST approach to ensuring the service's reliability and availability?

• A.A. Implement a redundant on-premises identity service as a backup to the cloud-based service
• B.B. Select a cloud-based identity service that provides a guaranteed uptime of 99.99% and has built-in redundancy and failover capabilities
• C.C. Develop a custom identity service in-house to replace the cloud-based service
• D.D. Establish a service level agreement (SLA) with the third-party provider that outlines expected uptime and response times

Why: Ensure the reliability and availability of third-party identity services for IAM Establishing an SLA with the third-party provider is the best approach, as it provides a contractual guarantee of the service's reliability and availability, and ensures that the provider is accountable for meeting specific service level targets.

A security manager is tasked with implementing authorization mechanisms for a new cloud-based application. What is the BEST approach to ensure fine-grained access control?

• A.Implement role-based access control (RBAC) with predefined roles
• B.Use attribute-based access control (ABAC) with dynamic policies
• C.Enforce mandatory access control (MAC) with strict labeling
• D.Use discretionary access control (DAC) with user-defined permissions

Why: Implementing fine-grained access control Using attribute-based access control (ABAC) with dynamic policies is the best approach to ensure fine-grained access control, as it allows for more nuanced and context-dependent access decisions.

You are the CISO of a company that is implementing a new authorization mechanism for its cloud-based services. What is the primary consideration when evaluating the effectiveness of an authorization protocol in controlling access to resources?

• A.The type of encryption used for data at rest
• B.The ability to integrate with existing identity and access management (IAM) systems
• C.The level of granularity provided by the authorization protocol
• D.The level of scalability and performance provided by the authorization protocol

Why: Evaluating authorization protocols requires careful consideration of the level of granularity provided The level of granularity provided by the authorization protocol is critical, as it determines the level of control over access to sensitive data and resources

As the CISO of a mid-sized enterprise, you are tasked with securing a newly acquired, previously unsecured facility that houses sensitive equipment and data. What should be done FIRST to establish control over physical access to the facility?

• A.Implement a multi-factor authentication system for all employees
• B.Conduct a thorough risk assessment to identify and prioritize physical security needs
• C.Install CCTV cameras and motion detectors throughout the facility
• D.Develop a comprehensive access control policy and procedure

Why: Conduct risk assessments to identify vulnerabilities in physical security controls Conducting a risk assessment is the first step in identifying vulnerabilities in the facility's physical security controls, which will inform the development of a comprehensive access control plan.

An organization is implementing a federated identity management system. What is the BEST approach to ensure seamless integration with existing systems?

• A.Use open standards such as SAML or OpenID Connect
• B.Develop custom integrations for each system
• C.Implement a separate identity management system for each department
• D.Outsource identity management to a third-party provider

Why: Understand the importance of standards in federated identity management Using open standards such as SAML or OpenID Connect enables seamless integration with existing systems and facilitates interoperability.