Study. uk . com
  1. Home
  2. All questions
  3. Access management

CISSP study material: Access management

37 questions of the 500 in the CISSP — Certified Information Systems Security Professional quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

  1. 22. A retailer is redesigning access after a breach in which an intruder who reached one internal subnet moved freely between servers. The architects want the model described in NIST SP 800-207 zero trust architecture. Which principle should drive the redesign?
  2. 23. An engineer is building the access flow for a zero trust architecture. A contractor signs in with MFA from a laptop the enterprise has never seen and requests a session to an internal application. Which sequencing matches the SP 800-207 model?
  3. 45. A bank is adding face recognition as an authentication factor. Testing shows the algorithm performs worse for one demographic group, so the vendor offers to lower the match threshold for that group so acceptance rates even out. Under NIST SP 800-63B-4, how should the bank respond to the offer?
  4. 47. An agency runs a case-management system at Authentication Assurance Level 3 (AAL3). Analysts complain about being signed out during long reviews and ask to inherit the timings used by the intranet, which runs at Authentication Assurance Level 2 (AAL2). Under NIST SP 800-63B-4, which session limits must the case-management system keep?
  5. 48. A brokerage federates staff logins to an external identity provider. The risk team's worry is a breach of that provider itself: an attacker who controls it could mint assertions naming any employee. Which federation assurance level 3 (FAL3) requirement addresses that specific worry?
  6. 49. Two research institutes agree to federate under the SP 800-63C-4 federation guidance. They share no common public key infrastructure and neither will join the other's, yet their architects want federation assurance level 3 (FAL3) for a jointly funded data programme. Which binding approach suits this deployment?
  7. 50. A SaaS provider follows the SP 800-63C-4 back-channel presentation model between its identity provider and several relying parties. To cut load, its gateway caches each assertion reference and lets any registered relying party redeem it for up to an hour. Which change aligns the design with that model?
  8. 51. A penetration test of an internal staff portal reports that the administrative menu is hidden by JavaScript for standard users, but a command-line HTTP client calling the /admin/users endpoint with an ordinary user's session returns the full staff list. Which remediation addresses the underlying broken access control?
  9. 52. An architect replaces static group permissions on a research data platform with attribute based access control (ABAC), so that the particulars of each request decide the outcome rather than a fixed grant. Which inputs does the ABAC decision test against the rule set? Choose three.
  10. 75. A retail platform authenticates users with stateless JSON Web Tokens (JWTs) that live twelve hours. After an account takeover, support uses "log out all devices" and the attacker's token keeps working until it expires. The team must make logout effective while still letting ordinary customer sessions last a long time. Which design meets both goals?
  11. 208. A zero trust deployment restricts what each subject may open, but every subject can still enumerate the full catalogue of resources. Which aspect of least privilege does SP 800-207 say is missing?
  12. 337. An architect describes access control lists and role based access control as fundamentally different models from attribute based access control. How does NIST SP 800-162 frame the relationship?
  13. 338. In role based access control, who determines what a subject may reach? Choose two.
  14. 339. An architect argues that role based and attribute based control cannot coexist because roles are not attributes. What does NIST SP 800-162 say?
  15. 340. What effect does NIST SP 800-162 attribute to the spread of role based access control in enterprises?
  16. 341. An organisation relying on access control lists finds long-serving staff hold far more access than their current jobs require. Which characteristic of the list model does NIST SP 800-162 identify as the cause?
  17. 342. Which four inputs does an attribute based access control mechanism combine to reach a decision, according to NIST SP 800-162?
  18. 343. Which of the following are environment conditions in the attribute based access control model, as opposed to subject or object attributes? Choose three.
  19. 344. A document is owned by one organisation but includes a section carrying another organisation's intellectual property. What does NIST SP 800-162 say about attributes in such a case?
  20. 345. Which access control framework does NIST SP 800-162 name as consistent with the attribute based access control model?
  21. 346. An auditor must show that a stated access requirement is met across an estate using access control lists and roles. Which two difficulties does NIST SP 800-162 identify? Choose two.
  22. 347. A photo printing site lets a user grant it access to photos held in a separate storage service. Mapping this to the four OAuth 2.0 roles, which pairing is correct?
  23. 348. Which two statements about the OAuth 2.0 authorization server match RFC 6749? Choose two.
  24. 349. A developer asks whether an OAuth access token can be parsed by the client to read the granted scope. What does RFC 6749 say about token form?
  25. 350. Which two benefits does RFC 6749 attribute to the access token acting as an abstraction over the underlying authorization grant? Choose two.
  26. 351. Which two statements about OAuth 2.0 refresh tokens match RFC 6749? Choose two.
  27. 352. A single-page application running entirely in the browser is being registered with an authorization server. Which OAuth client type is it, and why?
  28. 353. An application has a server-side component that can hold a secret and a browser component that cannot. What does RFC 6749 recommend when the authorization server offers no explicit support for such clients?
  29. 354. A service receives a JSON web token whose audience claim names a different service. What does RFC 7519 require it to do?
  30. 355. A resource server accepts JSON web tokens up to an hour past their expiry to accommodate clock differences between hosts. What does RFC 7519 permit?
  31. 356. Two identity providers both issue tokens with the subject value "admin" and a relying party trusts both. Which requirement of RFC 7519 addresses this hazard?
  32. 357. A library accepts a JSON web token whose algorithm header is set to none. Under RFC 7519, what is such a token and when is it intended to be used?
  33. 358. A team assumes a JSON web token is malformed because it carries no expiry claim. What does RFC 7519 say about the registered claims?
  34. 359. An administrator who configures user permissions is also the person who reviews the audit logs recording permission changes. Which control does SP 800-53 name for this, and what example does it give?
  35. 360. A manager argues that separation of duties makes fraud impossible. What does SP 800-53 actually claim for the control?
  36. 361. A batch job runs as a domain administrator because that was the simplest way to grant it file access. Which two points from SP 800-53's least privilege control apply? Choose two.
  37. 362. A design permits a cleared analyst to read a classified report but must also stop that report being copied to a system rated for lower classification. Which SP 800-53 control addresses the second requirement?