Topic 19 Practice Test 1 covers Identity and Access Management for CompTIA Security+ SY0-701 and maps to objective 4.6: Given a scenario, implement and maintain identity and access management. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
To let owners delegate access to resources they control, which security approach should be selected?
- Discretionary access control (DAC)
- LDAP
- Federation
- Security key
Correct Answer: A
Correct Answer
Answer A is correct because Discretionary access control (DAC) means an access model in which resource owners can grant or modify access permissions. The deciding point is functional fit: this option covers the stated need, while LDAP addresses a protocol for querying and modifying directory services containing identities and related attributes.
Incorrect Answers
Answer B is incorrect because LDAP refers to a protocol for querying and modifying directory services containing identities and related attributes. The concept is valid, but it does not match this stem. The required function is an access model in which resource owners can grant or modify access permissions, which maps to Discretionary access control (DAC).
Answer C is incorrect because Federation refers to trust arrangement that lets identities from one security domain access resources in another without separate local credentials. That concept can be valid in another scenario, but this question is testing an access model in which resource owners can grant or modify access permissions; Discretionary access control (DAC) therefore fits the requirement more directly.
Answer D is incorrect because Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The key mismatch is functional: Discretionary access control (DAC) addresses an access model in which resource owners can grant or modify access permissions, the need stated by the question.
Question 2
Which XML-based standard commonly is used to exchange authentication and authorization assertions between identity providers and service providers?
- Identity proofing
- OAuth
- SAML
- User deprovisioning
Correct Answer: C
Correct Answer
Answer C is correct because SAML means an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers. The deciding point is functional fit: this option covers the stated need, while OAuth addresses an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.
Incorrect Answers
Answer A is incorrect because Identity proofing refers to verification of a person’s real-world identity before issuing credentials or establishing an account. The concept is valid, but it does not match this stem. The required function is an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers, which maps to SAML.
Answer B is incorrect because OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. This could be appropriate elsewhere, but the required function is an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers; that makes SAML the precise choice.
Answer D is incorrect because User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required. The key mismatch is functional: SAML addresses an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers, the need stated by the question.
Question 3
Which authorization framework lets a user grant an application limited access to a resource without sharing the user’s password with that application?
- Biometric factor
- User provisioning
- OAuth
- Password manager
Correct Answer: C
Correct Answer
Answer C is correct because OAuth means an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. This matches the requirement as written. Biometric factor can be valid in another context, but it is used for an authentication factor based on a physical or behavioral characteristic of a person.
Incorrect Answers
Answer A is incorrect because Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person. The question is not asking for this function. It is testing an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application, so OAuth is the stronger fit.
Answer B is incorrect because User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity. The question is not asking for this function. It is testing an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application, so OAuth is the stronger fit.
Answer D is incorrect because Password manager refers to software that securely stores and often generates unique credentials. The scenario instead requires an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application, which is why OAuth is the better answer; this option serves the different function defined above.
Question 4
To reduce misuse and limit impact if an account is compromised, which security approach should be selected?
- Security key
- Mandatory access control (MAC)
- Discretionary access control (DAC)
- Least privilege
Correct Answer: D
Correct Answer
Answer D is correct because Least privilege means the principle of granting only the access required to perform assigned duties. The deciding point is functional fit: this option covers the stated need, while Discretionary access control (DAC) addresses an access model in which resource owners can grant or modify access permissions.
Incorrect Answers
Answer A is incorrect because Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The key mismatch is functional: Least privilege addresses the principle of granting only the access required to perform assigned duties, the need stated by the question.
Answer B is incorrect because Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. The scenario instead requires the principle of granting only the access required to perform assigned duties, which is why Least privilege is the better answer; this option serves the different function defined above.
Answer C is incorrect because Discretionary access control (DAC) refers to an access model in which resource owners can grant or modify access permissions. The scenario instead requires the principle of granting only the access required to perform assigned duties, which is why Least privilege is the better answer; this option serves the different function defined above.
Question 5
To reduce phishing and password-reuse risk, which security approach should be selected?
- Passwordless authentication
- Privileged access management (PAM)
- Least privilege
- Attestation
Correct Answer: A
Correct Answer
Answer A is correct because Passwordless authentication means authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. The deciding point is functional fit: this option covers the stated need, while Privileged access management (PAM) addresses processes and tools that tightly control, monitor, and audit administrative or high-impact access.
Incorrect Answers
Answer B is incorrect because Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access. The concept is valid, but it does not match this stem. The required function is authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics, which maps to Passwordless authentication.
Answer C is incorrect because Least privilege refers to the principle of granting only the access required to perform assigned duties. The key mismatch is functional: Passwordless authentication addresses authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics, the need stated by the question.
Answer D is incorrect because Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. The concept is valid, but it does not match this stem. The required function is authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics, which maps to Passwordless authentication.
Question 6
Two requirements remain open in an identity and privileged-access design review: authentication using factors from more than one category such as knowledge, possession, or inherence; controlled storage and checkout or brokering of privileged credentials. Which TWO options close those specific gaps? Choose TWO.
- Multifactor authentication
- Ephemeral credential
- Single sign-on (SSO)
- Password vaulting
- Password manager
Correct Answers: A, D
Correct Answers
Answer A is correct because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence. One required function is exactly what this option provides. Password manager may be useful elsewhere, but it is used for software that securely stores and often generates unique credentials.
Answer D is correct because Password vaulting means controlled storage and checkout or brokering of privileged credentials. This option satisfies a specific requirement in the stem; Password manager serves software that securely stores and often generates unique credentials and therefore is not interchangeable with it.
Incorrect Answers
Answer B is incorrect because Ephemeral credential means a short-lived credential created for a limited session or task. The question requires exactly 2 selections: Multifactor authentication, Password vaulting. This option falls outside that required set. For example, Password vaulting is required for controlled storage and checkout or brokering of privileged credentials.
Answer C is incorrect because Single sign-on (SSO) means authentication arrangement that lets a user authenticate once and access multiple integrated services. The question requires exactly 2 selections: Multifactor authentication, Password vaulting. This option falls outside that required set.
Answer E is incorrect because Password manager means software that securely stores and often generates unique credentials. The fixed-count answer set is Multifactor authentication, Password vaulting; this option does not fill one of those named functions. For example, Multifactor authentication is required for authentication using factors from more than one category such as knowledge, possession, or inherence.
Question 7
To provide phishing-resistant possession-based authentication, which security approach should be selected?
- Security key
- Biometric factor
- Privileged access management (PAM)
- Attestation
Correct Answer: A
Correct Answer
Answer A is correct because Security key means a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The requirement maps directly to this function, whereas Attestation is aimed at formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.
Incorrect Answers
Answer B is incorrect because Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person. The key mismatch is functional: Security key addresses a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols, the need stated by the question.
Answer C is incorrect because Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access. The question is not asking for this function. It is testing a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols, so Security key is the stronger fit.
Answer D is incorrect because Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. The scenario instead requires a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols, which is why Security key is the better answer; this option serves the different function defined above.
Question 8
To reduce account takeover risk when one credential factor is stolen, which security approach should be selected?
- Privileged access management (PAM)
- Multifactor authentication
- Ephemeral credential
- Passwordless authentication
Correct Answer: B
Correct Answer
Answer B is correct because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence. This matches the requirement as written. Ephemeral credential can be valid in another context, but it is used for a short-lived credential created for a limited session or task.
Incorrect Answers
Answer A is incorrect because Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access. This could be appropriate elsewhere, but the required function is authentication using factors from more than one category such as knowledge, possession, or inherence; that makes Multifactor authentication the precise choice.
Answer C is incorrect because Ephemeral credential refers to a short-lived credential created for a limited session or task. This could be appropriate elsewhere, but the required function is authentication using factors from more than one category such as knowledge, possession, or inherence; that makes Multifactor authentication the precise choice.
Answer D is incorrect because Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. This could be appropriate elsewhere, but the required function is authentication using factors from more than one category such as knowledge, possession, or inherence; that makes Multifactor authentication the precise choice.
Question 9
To use something the user is as part of identity verification, which security approach should be selected?
- Hardware token
- Biometric factor
- Passwordless authentication
- Security key
Correct Answer: B
Correct Answer
Answer B is correct because Biometric factor means an authentication factor based on a physical or behavioral characteristic of a person. That makes it the best answer here; Hardware token addresses a physical device that generates, stores, or proves possession of authentication material, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Hardware token refers to a physical device that generates, stores, or proves possession of authentication material. The concept is valid, but it does not match this stem. The required function is an authentication factor based on a physical or behavioral characteristic of a person, which maps to Biometric factor.
Answer C is incorrect because Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. The scenario instead requires an authentication factor based on a physical or behavioral characteristic of a person, which is why Biometric factor is the better answer; this option serves the different function defined above.
Answer D is incorrect because Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. That concept can be valid in another scenario, but this question is testing an authentication factor based on a physical or behavioral characteristic of a person; Biometric factor therefore fits the requirement more directly.
Question 10
An architect working on an identity and privileged-access design review needs one capability that provides authentication using factors from more than one category such as knowledge, possession, or inherence and another that provides short-lived credential created for a limited session or task. Which TWO selections are the best match? Choose TWO.
- Mandatory access control (MAC)
- Ephemeral credential
- Passwordless authentication
- Multifactor authentication
- Hardware token
Correct Answers: B, D
Correct Answers
Answer B is correct because Ephemeral credential means a short-lived credential created for a limited session or task. One required function is exactly what this option provides. Passwordless authentication may be useful elsewhere, but it is used for authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.
Answer D is correct because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence. The fixed-count item needs this function in the answer set. Hardware token covers a physical device that generates, stores, or proves possession of authentication material, a different requirement.
Incorrect Answers
Answer A is incorrect because Mandatory access control (MAC) means an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. The scenario calls for Multifactor authentication, Ephemeral credential. Selecting this option would leave one of those required functions uncovered.
Answer C is incorrect because Passwordless authentication means authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. The question requires exactly 2 selections: Multifactor authentication, Ephemeral credential. This option falls outside that required set.
Answer E is incorrect because Hardware token means a physical device that generates, stores, or proves possession of authentication material. The question requires exactly 2 selections: Multifactor authentication, Ephemeral credential. This option falls outside that required set. For example, Ephemeral credential is required for a short-lived credential created for a limited session or task.
Question 11
To extend identity trust across organizations or services, which security approach should be selected?
- Hardware token
- Passwordless authentication
- Federation
- User provisioning
Correct Answer: C
Correct Answer
Answer C is correct because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials. That makes it the best answer here; Passwordless authentication addresses authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Hardware token refers to a physical device that generates, stores, or proves possession of authentication material. This could be appropriate elsewhere, but the required function is trust arrangement that lets identities from one security domain access resources in another without separate local credentials; that makes Federation the precise choice.
Answer B is incorrect because Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. The question is not asking for this function. It is testing trust arrangement that lets identities from one security domain access resources in another without separate local credentials, so Federation is the stronger fit.
Answer D is incorrect because User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity. The question is not asking for this function. It is testing trust arrangement that lets identities from one security domain access resources in another without separate local credentials, so Federation is the stronger fit.
Question 12
The control set for an identity and privileged-access design review must address both software that securely stores and often generates unique credentials and short-lived credential created for a limited session or task. Which TWO choices map directly to those needs? Choose TWO.
- Password manager
- Federation
- A second biometric characteristic without a physical authenticator
- OAuth
- Ephemeral credential
Correct Answers: A, E
Correct Answers
Answer A is correct because Password manager means software that securely stores and often generates unique credentials. This selection maps directly to one of the named needs. A second biometric characteristic without a physical authenticator addresses Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator, so it does not satisfy the same slot.
Answer E is correct because Ephemeral credential means a short-lived credential created for a limited session or task. This option satisfies a specific requirement in the stem; OAuth serves an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application and therefore is not interchangeable with it.
Incorrect Answers
Answer B is incorrect because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials. Every answer slot must map to a stated requirement. The correct set is Ephemeral credential, Password manager, so this option cannot replace one of those selections.
Answer C is incorrect because Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator. The question requires exactly 2 selections: Ephemeral credential, Password manager. This option falls outside that required set.
Answer D is incorrect because OAuth means an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. The fixed-count answer set is Ephemeral credential, Password manager; this option does not fill one of those named functions.
Question 13
To make fine-grained dynamic authorization decisions from contextual policy, which security approach should be selected?
- Attribute-based access control (ABAC)
- Attestation
- SAML
- Ephemeral credential
Correct Answer: A
Correct Answer
Answer A is correct because Attribute-based access control (ABAC) means an access model that evaluates attributes of users, resources, actions, and environment. This is the precise fit for the scenario. SAML serves the different purpose of an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers.
Incorrect Answers
Answer B is incorrect because Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. The concept is valid, but it does not match this stem. The required function is an access model that evaluates attributes of users, resources, actions, and environment, which maps to Attribute-based access control (ABAC).
Answer C is incorrect because SAML refers to an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers. The scenario instead requires an access model that evaluates attributes of users, resources, actions, and environment, which is why Attribute-based access control (ABAC) is the better answer; this option serves the different function defined above.
Answer D is incorrect because Ephemeral credential refers to a short-lived credential created for a limited session or task. The concept is valid, but it does not match this stem. The required function is an access model that evaluates attributes of users, resources, actions, and environment, which maps to Attribute-based access control (ABAC).
Question 14
Which term describes removal or disabling of accounts and permissions when access is no longer required?
- Federation
- User deprovisioning
- Least privilege
- Ephemeral credential
Correct Answer: B
Correct Answer
Answer B is correct because User deprovisioning means removal or disabling of accounts and permissions when access is no longer required. This is the precise fit for the scenario. Ephemeral credential serves the different purpose of a short-lived credential created for a limited session or task.
Incorrect Answers
Answer A is incorrect because Federation refers to trust arrangement that lets identities from one security domain access resources in another without separate local credentials. The concept is valid, but it does not match this stem. The required function is removal or disabling of accounts and permissions when access is no longer required, which maps to User deprovisioning.
Answer C is incorrect because Least privilege refers to the principle of granting only the access required to perform assigned duties. That concept can be valid in another scenario, but this question is testing removal or disabling of accounts and permissions when access is no longer required; User deprovisioning therefore fits the requirement more directly.
Answer D is incorrect because Ephemeral credential refers to a short-lived credential created for a limited session or task. The key mismatch is functional: User deprovisioning addresses removal or disabling of accounts and permissions when access is no longer required, the need stated by the question.
Question 15
During an identity and privileged-access design review, the team has two independent requirements: (1) verification of a person’s real-world identity before issuing credentials or establishing an account; and (2) formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. Which TWO choices best satisfy those requirements? Choose TWO.
- User provisioning
- Identity proofing
- Mandatory access control (MAC)
- Attestation
- Biometric factor
Correct Answers: B, D
Correct Answers
Answer B is correct because Identity proofing means verification of a person’s real-world identity before issuing credentials or establishing an account. It belongs in the fixed-count answer set because it covers one of the stated requirements. Mandatory access control (MAC) instead serves an access model in which centrally defined labels and policy determine access and users cannot freely change permissions and cannot replace this function.
Answer D is correct because Attestation means formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. One required function is exactly what this option provides. Mandatory access control (MAC) may be useful elsewhere, but it is used for an access model in which centrally defined labels and policy determine access and users cannot freely change permissions.
Incorrect Answers
Answer A is incorrect because User provisioning means creation and assignment of accounts, attributes, groups, and access for an identity. Every answer slot must map to a stated requirement. The correct set is Identity proofing, Attestation, so this option cannot replace one of those selections.
Answer C is incorrect because Mandatory access control (MAC) means an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. The question requires exactly 2 selections: Identity proofing, Attestation. This option falls outside that required set.
Answer E is incorrect because Biometric factor means an authentication factor based on a physical or behavioral characteristic of a person. The question requires exactly 2 selections: Identity proofing, Attestation. This option falls outside that required set. For example, Identity proofing is required for verification of a person’s real-world identity before issuing credentials or establishing an account.
Question 16
Which term describes creation and assignment of accounts, attributes, groups, and access for an identity?
- Security key
- Biometric factor
- Multifactor authentication
- User provisioning
Correct Answer: D
Correct Answer
Answer D is correct because User provisioning means creation and assignment of accounts, attributes, groups, and access for an identity. That is the function the question is testing. Multifactor authentication would instead be used for authentication using factors from more than one category such as knowledge, possession, or inherence.
Incorrect Answers
Answer A is incorrect because Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The concept is valid, but it does not match this stem. The required function is creation and assignment of accounts, attributes, groups, and access for an identity, which maps to User provisioning.
Answer B is incorrect because Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person. This could be appropriate elsewhere, but the required function is creation and assignment of accounts, attributes, groups, and access for an identity; that makes User provisioning the precise choice.
Answer C is incorrect because Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence. This could be appropriate elsewhere, but the required function is creation and assignment of accounts, attributes, groups, and access for an identity; that makes User provisioning the precise choice.
Question 17
During an identity and privileged-access design review, three requirements must be addressed: (1) access model in which resource owners can grant or modify access permissions; (2) access model that assigns permissions to job roles and then assigns users to those roles; and (3) authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. Which THREE choices best satisfy them? Choose THREE.
- A second biometric characteristic without a physical authenticator
- Security key
- Discretionary access control (DAC)
- Passwordless authentication
- Role-based access control (RBAC)
- Privileged access management (PAM)
Correct Answers: C, D, E
Correct Answers
Answer C is correct because Discretionary access control (DAC) means an access model in which resource owners can grant or modify access permissions. It belongs in the fixed-count answer set because it covers one of the stated requirements. Privileged access management (PAM) instead serves processes and tools that tightly control, monitor, and audit administrative or high-impact access and cannot replace this function.
Answer D is correct because Passwordless authentication means authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. This selection maps directly to one of the named needs. Privileged access management (PAM) addresses processes and tools that tightly control, monitor, and audit administrative or high-impact access, so it does not satisfy the same slot.
Answer E is correct because Role-based access control (RBAC) means an access model that assigns permissions to job roles and then assigns users to those roles. The fixed-count item needs this function in the answer set. A second biometric characteristic without a physical authenticator covers Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator, a different requirement.
Incorrect Answers
Answer A is incorrect because Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator. Every answer slot must map to a stated requirement. The correct set is Discretionary access control (DAC), Passwordless authentication, Role-based access control (RBAC), so this option cannot replace one of those selections.
Answer B is incorrect because Security key means a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The required choices are Discretionary access control (DAC), Passwordless authentication, Role-based access control (RBAC). Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer F is incorrect because Privileged access management (PAM) means processes and tools that tightly control, monitor, and audit administrative or high-impact access. The question requires exactly 3 selections: Discretionary access control (DAC), Passwordless authentication, Role-based access control (RBAC). This option falls outside that required set.
Question 18
An architect working on an identity and privileged-access design review needs one capability that provides authentication using factors from more than one category such as knowledge, possession, or inherence and another that provides authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. Which TWO selections are the best match? Choose TWO.
- A second biometric characteristic without a physical authenticator
- Least privilege
- Discretionary access control (DAC)
- Multifactor authentication
- Passwordless authentication
Correct Answers: D, E
Correct Answers
Answer D is correct because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence. The fixed-count item needs this function in the answer set. A second biometric characteristic without a physical authenticator covers Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator, a different requirement.
Answer E is correct because Passwordless authentication means authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. One required function is exactly what this option provides. Discretionary access control (DAC) may be useful elsewhere, but it is used for an access model in which resource owners can grant or modify access permissions.
Incorrect Answers
Answer A is incorrect because Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator. The required choices are Passwordless authentication, Multifactor authentication. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer B is incorrect because Least privilege means the principle of granting only the access required to perform assigned duties. The question requires exactly 2 selections: Passwordless authentication, Multifactor authentication. This option falls outside that required set. For example, Passwordless authentication is required for authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.
Answer C is incorrect because Discretionary access control (DAC) means an access model in which resource owners can grant or modify access permissions. The fixed-count answer set is Passwordless authentication, Multifactor authentication; this option does not fill one of those named functions.
Question 19
To manage access efficiently for groups with common responsibilities, which security approach should be selected?
- Multifactor authentication
- User deprovisioning
- Attribute-based access control (ABAC)
- Role-based access control (RBAC)
Correct Answer: D
Correct Answer
Answer D is correct because Role-based access control (RBAC) means an access model that assigns permissions to job roles and then assigns users to those roles. This is the precise fit for the scenario. User deprovisioning serves the different purpose of removal or disabling of accounts and permissions when access is no longer required.
Incorrect Answers
Answer A is incorrect because Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence. The concept is valid, but it does not match this stem. The required function is an access model that assigns permissions to job roles and then assigns users to those roles, which maps to Role-based access control (RBAC).
Answer B is incorrect because User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required. The question is not asking for this function. It is testing an access model that assigns permissions to job roles and then assigns users to those roles, so Role-based access control (RBAC) is the stronger fit.
Answer C is incorrect because Attribute-based access control (ABAC) refers to an access model that evaluates attributes of users, resources, actions, and environment. The question is not asking for this function. It is testing an access model that assigns permissions to job roles and then assigns users to those roles, so Role-based access control (RBAC) is the stronger fit.
Question 20
Which physical device generates, stores, or proves possession of authentication material?
- Federation
- Hardware token
- Multifactor authentication
- Discretionary access control (DAC)
Correct Answer: B
Correct Answer
Answer B is correct because Hardware token means a physical device that generates, stores, or proves possession of authentication material. This is the precise fit for the scenario. Discretionary access control (DAC) serves the different purpose of an access model in which resource owners can grant or modify access permissions.
Incorrect Answers
Answer A is incorrect because Federation refers to trust arrangement that lets identities from one security domain access resources in another without separate local credentials. The concept is valid, but it does not match this stem. The required function is a physical device that generates, stores, or proves possession of authentication material, which maps to Hardware token.
Answer C is incorrect because Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence. That concept can be valid in another scenario, but this question is testing a physical device that generates, stores, or proves possession of authentication material; Hardware token therefore fits the requirement more directly.
Answer D is incorrect because Discretionary access control (DAC) refers to an access model in which resource owners can grant or modify access permissions. The concept is valid, but it does not match this stem. The required function is a physical device that generates, stores, or proves possession of authentication material, which maps to Hardware token.
