Topic 19 Practice Test 2 covers Identity and Access Management for CompTIA Security+ SY0-701 and maps to objective 4.6: Given a scenario, implement and maintain identity and access management. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
To reduce repeated logins while centralizing authentication control, which security approach should be selected?
- User deprovisioning
- Single sign-on (SSO)
- Biometric factor
- Attestation
Correct Answer: B
Correct Answer
Answer B is correct because Single sign-on (SSO) means authentication arrangement that lets a user authenticate once and access multiple integrated services. That is the function the question is testing. User deprovisioning would instead be used for removal or disabling of accounts and permissions when access is no longer required.
Incorrect Answers
Answer A is incorrect because User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required. The question is not asking for this function. It is testing authentication arrangement that lets a user authenticate once and access multiple integrated services, so Single sign-on (SSO) is the stronger fit.
Answer C is incorrect because Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person. The key mismatch is functional: Single sign-on (SSO) addresses authentication arrangement that lets a user authenticate once and access multiple integrated services, the need stated by the question.
Answer D is incorrect because Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. The scenario instead requires authentication arrangement that lets a user authenticate once and access multiple integrated services, which is why Single sign-on (SSO) is the better answer; this option serves the different function defined above.
Question 2
A review during an identity and privileged-access design review identifies two gaps. One requires authentication arrangement that lets a user authenticate once and access multiple integrated services. The other requires access model that assigns permissions to job roles and then assigns users to those roles. Which TWO options should be included in the remediation plan? Choose TWO.
- Role-based access control (RBAC)
- OAuth
- Ephemeral credential
- Single sign-on (SSO)
- SAML
Correct Answers: A, D
Correct Answers
Answer A is correct because Role-based access control (RBAC) means an access model that assigns permissions to job roles and then assigns users to those roles. This option satisfies a specific requirement in the stem; OAuth serves an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application and therefore is not interchangeable with it.
Answer D is correct because Single sign-on (SSO) means authentication arrangement that lets a user authenticate once and access multiple integrated services. One required function is exactly what this option provides. SAML may be useful elsewhere, but it is used for an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers.
Incorrect Answers
Answer B is incorrect because OAuth means an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. The question requires exactly 2 selections: Single sign-on (SSO), Role-based access control (RBAC). This option falls outside that required set.
Answer C is incorrect because Ephemeral credential means a short-lived credential created for a limited session or task. The fixed-count answer set is Single sign-on (SSO), Role-based access control (RBAC); this option does not fill one of those named functions.
Answer E is incorrect because SAML means an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers. Every answer slot must map to a stated requirement. The correct set is Single sign-on (SSO), Role-based access control (RBAC), so this option cannot replace one of those selections.
Question 3
To delegate scoped API access between applications and services, which security approach should be selected?
- Privileged access management (PAM)
- Least privilege
- Biometric factor
- OAuth
Correct Answer: D
Correct Answer
Answer D is correct because OAuth means an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. The deciding point is functional fit: this option covers the stated need, while Biometric factor addresses an authentication factor based on a physical or behavioral characteristic of a person.
Incorrect Answers
Answer A is incorrect because Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access. The key mismatch is functional: OAuth addresses an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application, the need stated by the question.
Answer B is incorrect because Least privilege refers to the principle of granting only the access required to perform assigned duties. The key mismatch is functional: OAuth addresses an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application, the need stated by the question.
Answer C is incorrect because Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person. The question is not asking for this function. It is testing an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application, so OAuth is the stronger fit. This question specifically tests the requirement represented by OAuth.
Question 4
To ensure the digital identity is bound to the correct individual, which security approach should be selected?
- Attestation
- Identity proofing
- Passwordless authentication
- User deprovisioning
Correct Answer: B
Correct Answer
Answer B is correct because Identity proofing means verification of a person’s real-world identity before issuing credentials or establishing an account. That is the function the question is testing. Attestation would instead be used for formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.
Incorrect Answers
Answer A is incorrect because Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. That concept can be valid in another scenario, but this question is testing verification of a person’s real-world identity before issuing credentials or establishing an account; Identity proofing therefore fits the requirement more directly.
Answer C is incorrect because Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. The key mismatch is functional: Identity proofing addresses verification of a person’s real-world identity before issuing credentials or establishing an account, the need stated by the question.
Answer D is incorrect because User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required. The key mismatch is functional: Identity proofing addresses verification of a person’s real-world identity before issuing credentials or establishing an account, the need stated by the question.
Question 5
Which term describes verification of a person’s real-world identity before issuing credentials or establishing an account?
- Identity proofing
- Mandatory access control (MAC)
- Attestation
- OAuth
Correct Answer: A
Correct Answer
Answer A is correct because Identity proofing means verification of a person’s real-world identity before issuing credentials or establishing an account. The deciding point is functional fit: this option covers the stated need, while OAuth addresses an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.
Incorrect Answers
Answer B is incorrect because Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. That concept can be valid in another scenario, but this question is testing verification of a person’s real-world identity before issuing credentials or establishing an account; Identity proofing therefore fits the requirement more directly.
Answer C is incorrect because Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. This could be appropriate elsewhere, but the required function is verification of a person’s real-world identity before issuing credentials or establishing an account; that makes Identity proofing the precise choice.
Answer D is incorrect because OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. The key mismatch is functional: Identity proofing addresses verification of a person’s real-world identity before issuing credentials or establishing an account, the need stated by the question.
Question 6
A review during an identity and privileged-access design review identifies two gaps. One requires formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. The other requires temporary elevation granted only when needed and removed automatically after a short period. Which TWO options should be included in the remediation plan? Choose TWO.
- Password vaulting
- Just-in-time permission
- A password as the only additional mechanism
- Attestation
- LDAP
Correct Answers: B, D
Correct Answers
Answer B is correct because Just-in-time permission means temporary elevation granted only when needed and removed automatically after a short period. This selection maps directly to one of the named needs. Password vaulting addresses controlled storage and checkout or brokering of privileged credentials, so it does not satisfy the same slot.
Answer D is correct because Attestation means formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. One required function is exactly what this option provides. Password vaulting may be useful elsewhere, but it is used for controlled storage and checkout or brokering of privileged credentials.
Incorrect Answers
Answer A is incorrect because Password vaulting means controlled storage and checkout or brokering of privileged credentials. The question requires exactly 2 selections: Just-in-time permission, Attestation. This option falls outside that required set. For example, Attestation is required for formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid.
Answer C is incorrect because A password supplies a knowledge factor but does not establish possession of the physical authenticator required by the cited guidance. Every answer slot must map to a stated requirement. The correct set is Just-in-time permission, Attestation, so this option cannot replace one of those selections.
Answer E is incorrect because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. Every answer slot must map to a stated requirement. The correct set is Just-in-time permission, Attestation, so this option cannot replace one of those selections.
Question 7
Two requirements remain open in an identity and privileged-access design review: protocol for querying and modifying directory services containing identities and related attributes; authentication using factors from more than one category such as knowledge, possession, or inherence. Which TWO options close those specific gaps? Choose TWO.
- Just-in-time permission
- Single sign-on (SSO)
- LDAP
- Ephemeral credential
- Multifactor authentication
Correct Answers: C, E
Correct Answers
Answer C is correct because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. The fixed-count item needs this function in the answer set. Single sign-on (SSO) covers authentication arrangement that lets a user authenticate once and access multiple integrated services, a different requirement.
Answer E is correct because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence. This selection maps directly to one of the named needs. Single sign-on (SSO) addresses authentication arrangement that lets a user authenticate once and access multiple integrated services, so it does not satisfy the same slot.
Incorrect Answers
Answer A is incorrect because Just-in-time permission means temporary elevation granted only when needed and removed automatically after a short period. The question requires exactly 2 selections: Multifactor authentication, LDAP. This option falls outside that required set. For example, LDAP is required for a protocol for querying and modifying directory services containing identities and related attributes.
Answer B is incorrect because Single sign-on (SSO) means authentication arrangement that lets a user authenticate once and access multiple integrated services. The scenario calls for Multifactor authentication, LDAP. Selecting this option would leave one of those required functions uncovered.
Answer D is incorrect because Ephemeral credential means a short-lived credential created for a limited session or task. Every answer slot must map to a stated requirement. The correct set is Multifactor authentication, LDAP, so this option cannot replace one of those selections.
Question 8
Which access model evaluates attributes of users, resources, actions, and environment?
- Attribute-based access control (ABAC)
- Multifactor authentication
- Single sign-on (SSO)
- OAuth
Correct Answer: A
Correct Answer
Answer A is correct because Attribute-based access control (ABAC) means an access model that evaluates attributes of users, resources, actions, and environment. That is the function the question is testing. Multifactor authentication would instead be used for authentication using factors from more than one category such as knowledge, possession, or inherence.
Incorrect Answers
Answer B is incorrect because Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence. The question is not asking for this function. It is testing an access model that evaluates attributes of users, resources, actions, and environment, so Attribute-based access control (ABAC) is the stronger fit.
Answer C is incorrect because Single sign-on (SSO) refers to authentication arrangement that lets a user authenticate once and access multiple integrated services. The key mismatch is functional: Attribute-based access control (ABAC) addresses an access model that evaluates attributes of users, resources, actions, and environment, the need stated by the question.
Answer D is incorrect because OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. This could be appropriate elsewhere, but the required function is an access model that evaluates attributes of users, resources, actions, and environment; that makes Attribute-based access control (ABAC) the precise choice.
Question 9
Which term describes trust arrangement that lets identities from one security domain access resources in another without separate local credentials?
- Password manager
- Federation
- Identity proofing
- Multifactor authentication
Correct Answer: B
Correct Answer
Answer B is correct because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials. This matches the requirement as written. Password manager can be valid in another context, but it is used for software that securely stores and often generates unique credentials.
Incorrect Answers
Answer A is incorrect because Password manager refers to software that securely stores and often generates unique credentials. The concept is valid, but it does not match this stem. The required function is trust arrangement that lets identities from one security domain access resources in another without separate local credentials, which maps to Federation.
Answer C is incorrect because Identity proofing refers to verification of a person’s real-world identity before issuing credentials or establishing an account. This could be appropriate elsewhere, but the required function is trust arrangement that lets identities from one security domain access resources in another without separate local credentials; that makes Federation the precise choice.
Answer D is incorrect because Multifactor authentication refers to authentication using factors from more than one category such as knowledge, possession, or inherence. That concept can be valid in another scenario, but this question is testing trust arrangement that lets identities from one security domain access resources in another without separate local credentials; Federation therefore fits the requirement more directly.
Question 10
Which access model assigns permissions to job roles and then assigns users to those roles?
- Ephemeral credential
- Mandatory access control (MAC)
- Role-based access control (RBAC)
- User deprovisioning
Correct Answer: C
Correct Answer
Answer C is correct because Role-based access control (RBAC) means an access model that assigns permissions to job roles and then assigns users to those roles. That is the function the question is testing. Ephemeral credential would instead be used for a short-lived credential created for a limited session or task.
Incorrect Answers
Answer A is incorrect because Ephemeral credential refers to a short-lived credential created for a limited session or task. The scenario instead requires an access model that assigns permissions to job roles and then assigns users to those roles, which is why Role-based access control (RBAC) is the better answer; this option serves the different function defined above.
Answer B is incorrect because Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. The concept is valid, but it does not match this stem. The required function is an access model that assigns permissions to job roles and then assigns users to those roles, which maps to Role-based access control (RBAC).
Answer D is incorrect because User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required. This could be appropriate elsewhere, but the required function is an access model that assigns permissions to job roles and then assigns users to those roles; that makes Role-based access control (RBAC) the precise choice.
Question 11
What is an access model in which resource owners can grant or modify access permissions?
- Ephemeral credential
- Just-in-time permission
- Discretionary access control (DAC)
- User deprovisioning
Correct Answer: C
Correct Answer
Answer C is correct because Discretionary access control (DAC) means an access model in which resource owners can grant or modify access permissions. This is the precise fit for the scenario. Ephemeral credential serves the different purpose of a short-lived credential created for a limited session or task.
Incorrect Answers
Answer A is incorrect because Ephemeral credential refers to a short-lived credential created for a limited session or task. The concept is valid, but it does not match this stem. The required function is an access model in which resource owners can grant or modify access permissions, which maps to Discretionary access control (DAC).
Answer B is incorrect because Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period. The question is not asking for this function. It is testing an access model in which resource owners can grant or modify access permissions, so Discretionary access control (DAC) is the stronger fit.
Answer D is incorrect because User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required. The key mismatch is functional: Discretionary access control (DAC) addresses an access model in which resource owners can grant or modify access permissions, the need stated by the question.
Question 12
During an identity and privileged-access design review, three requirements must be addressed: (1) creation and assignment of accounts, attributes, groups, and access for an identity; (2) access model in which centrally defined labels and policy determine access and users cannot freely change permissions; and (3) personal knowledge answer does not authenticate a physical authenticator or establish possession. Which THREE choices best satisfy them? Choose THREE.
- An answer to a personal knowledge question
- Federation
- User provisioning
- Password vaulting
- Mandatory access control (MAC)
- Passwordless authentication
Correct Answers: A, C, E
Correct Answers
Answer A is correct because A personal knowledge answer does not authenticate a physical authenticator or establish possession. This option satisfies a specific requirement in the stem; Password vaulting serves controlled storage and checkout or brokering of privileged credentials and therefore is not interchangeable with it.
Answer C is correct because User provisioning means creation and assignment of accounts, attributes, groups, and access for an identity. The fixed-count item needs this function in the answer set. Password vaulting covers controlled storage and checkout or brokering of privileged credentials, a different requirement.
Answer E is correct because Mandatory access control (MAC) means an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. This option satisfies a specific requirement in the stem; Passwordless authentication serves authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics and therefore is not interchangeable with it.
Incorrect Answers
Answer B is incorrect because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials. The question requires exactly 3 selections: An answer to a personal knowledge question, Mandatory access control (MAC), User provisioning. This option falls outside that required set.
Answer D is incorrect because Password vaulting means controlled storage and checkout or brokering of privileged credentials. The scenario calls for An answer to a personal knowledge question, Mandatory access control (MAC), User provisioning. Selecting this option would leave one of those required functions uncovered.
Answer F is incorrect because Passwordless authentication means authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. The fixed-count answer set is An answer to a personal knowledge question, Mandatory access control (MAC), User provisioning; this option does not fill one of those named functions.
Question 13
The control set for an identity and privileged-access design review must address both protocol for querying and modifying directory services containing identities and related attributes and another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator. Which TWO choices map directly to those needs? Choose TWO.
- Multifactor authentication
- Just-in-time permission
- A second biometric characteristic without a physical authenticator
- LDAP
- Hardware token
Correct Answers: C, D
Correct Answers
Answer C is correct because Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator. This selection maps directly to one of the named needs. Multifactor authentication addresses authentication using factors from more than one category such as knowledge, possession, or inherence, so it does not satisfy the same slot.
Answer D is correct because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. The fixed-count item needs this function in the answer set. Just-in-time permission covers temporary elevation granted only when needed and removed automatically after a short period, a different requirement.
Incorrect Answers
Answer A is incorrect because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence. The required choices are A second biometric characteristic without a physical authenticator, LDAP. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer B is incorrect because Just-in-time permission means temporary elevation granted only when needed and removed automatically after a short period. The required choices are A second biometric characteristic without a physical authenticator, LDAP. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Hardware token means a physical device that generates, stores, or proves possession of authentication material. The fixed-count answer set is A second biometric characteristic without a physical authenticator, LDAP; this option does not fill one of those named functions.
Question 14
Which term describes formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid?
- Least privilege
- OAuth
- User provisioning
- Attestation
Correct Answer: D
Correct Answer
Answer D is correct because Attestation means formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. The requirement maps directly to this function, whereas Least privilege is aimed at the principle of granting only the access required to perform assigned duties.
Incorrect Answers
Answer A is incorrect because Least privilege refers to the principle of granting only the access required to perform assigned duties. The key mismatch is functional: Attestation addresses formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid, the need stated by the question.
Answer B is incorrect because OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. The key mismatch is functional: Attestation addresses formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid, the need stated by the question.
Answer C is incorrect because User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity. The scenario instead requires formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid, which is why Attestation is the better answer; this option serves the different function defined above.
Question 15
Which term describes processes and tools that tightly control, monitor, and audit administrative or high-impact access?
- Passwordless authentication
- Attribute-based access control (ABAC)
- Privileged access management (PAM)
- OAuth
Correct Answer: C
Correct Answer
Answer C is correct because Privileged access management (PAM) means processes and tools that tightly control, monitor, and audit administrative or high-impact access. The deciding point is functional fit: this option covers the stated need, while Passwordless authentication addresses authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.
Incorrect Answers
Answer A is incorrect because Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. This could be appropriate elsewhere, but the required function is processes and tools that tightly control, monitor, and audit administrative or high-impact access; that makes Privileged access management (PAM) the precise choice.
Answer B is incorrect because Attribute-based access control (ABAC) refers to an access model that evaluates attributes of users, resources, actions, and environment. The scenario instead requires processes and tools that tightly control, monitor, and audit administrative or high-impact access, which is why Privileged access management (PAM) is the better answer; this option serves the different function defined above.
Answer D is incorrect because OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. The scenario instead requires processes and tools that tightly control, monitor, and audit administrative or high-impact access, which is why Privileged access management (PAM) is the better answer; this option serves the different function defined above.
Question 16
An organization uses fingerprint comparison for remote digital authentication. Under NIST biometric guidance, what must be authenticated alongside the biometric comparison?
- An answer to a personal knowledge question
- A physical authenticator that establishes possession
- A password as the only additional mechanism
- A second biometric characteristic without a physical authenticator
Correct Answer: B
Correct Answer
Answer B is correct because A biometric comparison must be combined with authentication of a physical authenticator. The requirement maps directly to this function, whereas A second biometric characteristic without a physical authenticator is aimed at Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator.
Incorrect Answers
Answer A is incorrect because A personal knowledge answer does not authenticate a physical authenticator or establish possession. The scenario instead requires A biometric comparison must be combined with authentication of a physical authenticator, which is why A physical authenticator that establishes possession is the better answer; this option serves the different function defined above.
Answer C is incorrect because A password supplies a knowledge factor but does not establish possession of the physical authenticator required by the cited guidance. The question is not asking for this function. It is testing A biometric comparison must be combined with authentication of a physical authenticator, so A physical authenticator that establishes possession is the stronger fit.
Answer D is incorrect because Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator. That concept can be valid in another scenario, but this question is testing A biometric comparison must be combined with authentication of a physical authenticator; A physical authenticator that establishes possession therefore fits the requirement more directly.
Question 17
To prevent former or transferred users from retaining unnecessary access, which security approach should be selected?
- Password vaulting
- OAuth
- Mandatory access control (MAC)
- User deprovisioning
Correct Answer: D
Correct Answer
Answer D is correct because User deprovisioning means removal or disabling of accounts and permissions when access is no longer required. That makes it the best answer here; Mandatory access control (MAC) addresses an access model in which centrally defined labels and policy determine access and users cannot freely change permissions, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Password vaulting refers to controlled storage and checkout or brokering of privileged credentials. This could be appropriate elsewhere, but the required function is removal or disabling of accounts and permissions when access is no longer required; that makes User deprovisioning the precise choice.
Answer B is incorrect because OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. That concept can be valid in another scenario, but this question is testing removal or disabling of accounts and permissions when access is no longer required; User deprovisioning therefore fits the requirement more directly.
Answer C is incorrect because Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. The question is not asking for this function. It is testing removal or disabling of accounts and permissions when access is no longer required, so User deprovisioning is the stronger fit.
Question 18
To support browser-based enterprise federation and SSO, which security approach should be selected?
- SAML
- Just-in-time permission
- Discretionary access control (DAC)
- LDAP
Correct Answer: A
Correct Answer
Answer A is correct because SAML means an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers. The requirement maps directly to this function, whereas Discretionary access control (DAC) is aimed at an access model in which resource owners can grant or modify access permissions.
Incorrect Answers
Answer B is incorrect because Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period. The key mismatch is functional: SAML addresses an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers, the need stated by the question.
Answer C is incorrect because Discretionary access control (DAC) refers to an access model in which resource owners can grant or modify access permissions. The key mismatch is functional: SAML addresses an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers, the need stated by the question.
Answer D is incorrect because LDAP refers to a protocol for querying and modifying directory services containing identities and related attributes. This could be appropriate elsewhere, but the required function is an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers; that makes SAML the precise choice.
Question 19
To grant a new or changing user the access required for their role, which security approach should be selected?
- Privileged access management (PAM)
- Passwordless authentication
- User provisioning
- Security key
Correct Answer: C
Correct Answer
Answer C is correct because User provisioning means creation and assignment of accounts, attributes, groups, and access for an identity. That makes it the best answer here; Passwordless authentication addresses authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access. The scenario instead requires creation and assignment of accounts, attributes, groups, and access for an identity, which is why User provisioning is the better answer; this option serves the different function defined above.
Answer B is incorrect because Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. The key mismatch is functional: User provisioning addresses creation and assignment of accounts, attributes, groups, and access for an identity, the need stated by the question.
Answer D is incorrect because Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The question is not asking for this function. It is testing creation and assignment of accounts, attributes, groups, and access for an identity, so User provisioning is the stronger fit.
Question 20
Two requirements remain open in an identity and privileged-access design review: creation and assignment of accounts, attributes, groups, and access for an identity; principle of granting only the access required to perform assigned duties. Which TWO options close those specific gaps? Choose TWO.
- User provisioning
- User deprovisioning
- Hardware token
- Least privilege
- Discretionary access control (DAC)
Correct Answers: A, D
Correct Answers
Answer A is correct because User provisioning means creation and assignment of accounts, attributes, groups, and access for an identity. The fixed-count item needs this function in the answer set. Hardware token covers a physical device that generates, stores, or proves possession of authentication material, a different requirement.
Answer D is correct because Least privilege means the principle of granting only the access required to perform assigned duties. This selection maps directly to one of the named needs. Discretionary access control (DAC) addresses an access model in which resource owners can grant or modify access permissions, so it does not satisfy the same slot.
Incorrect Answers
Answer B is incorrect because User deprovisioning means removal or disabling of accounts and permissions when access is no longer required. The required choices are User provisioning, Least privilege. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer C is incorrect because Hardware token means a physical device that generates, stores, or proves possession of authentication material. The scenario calls for User provisioning, Least privilege. Selecting this option would leave one of those required functions uncovered.
Answer E is incorrect because Discretionary access control (DAC) means an access model in which resource owners can grant or modify access permissions. The fixed-count answer set is User provisioning, Least privilege; this option does not fill one of those named functions.
