Topic 19 Practice Test 3 covers Identity and Access Management for CompTIA Security+ SY0-701 and maps to objective 4.6: Given a scenario, implement and maintain identity and access management. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
The team is resolving a gap found during an identity and privileged-access design review: it needs access model that assigns permissions to job roles and then assigns users to those roles. Which option is most appropriate?
- LDAP
- A second biometric characteristic without a physical authenticator
- Passwordless authentication
- Role-based access control (RBAC)
Correct Answer: D
Correct Answer
Answer D is correct because Role-based access control (RBAC) means an access model that assigns permissions to job roles and then assigns users to those roles. This is the precise fit for the scenario. Passwordless authentication serves the different purpose of authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.
Incorrect Answers
Answer A is incorrect because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. The concept is valid, but it does not match this stem. The required function is an access model that assigns permissions to job roles and then assigns users to those roles, which maps to Role-based access control (RBAC).
Answer B is incorrect because Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator. The concept is valid, but it does not match this stem. The required function is an access model that assigns permissions to job roles and then assigns users to those roles, which maps to Role-based access control (RBAC).
Answer C is incorrect because Passwordless authentication means authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. That concept can be valid in another scenario, but this question is testing an access model that assigns permissions to job roles and then assigns users to those roles; Role-based access control (RBAC) therefore fits the requirement more directly.
Question 2
Which term describes authentication arrangement that lets a user authenticate once and access multiple integrated services?
- User provisioning
- Hardware token
- Single sign-on (SSO)
- Password vaulting
Correct Answer: C
Correct Answer
Answer C is correct because Single sign-on (SSO) means authentication arrangement that lets a user authenticate once and access multiple integrated services. That makes it the best answer here; Password vaulting addresses controlled storage and checkout or brokering of privileged credentials, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity. The key mismatch is functional: Single sign-on (SSO) addresses authentication arrangement that lets a user authenticate once and access multiple integrated services, the need stated by the question.
Answer B is incorrect because Hardware token refers to a physical device that generates, stores, or proves possession of authentication material. The key mismatch is functional: Single sign-on (SSO) addresses authentication arrangement that lets a user authenticate once and access multiple integrated services, the need stated by the question.
Answer D is incorrect because Password vaulting refers to controlled storage and checkout or brokering of privileged credentials. The concept is valid, but it does not match this stem. The required function is authentication arrangement that lets a user authenticate once and access multiple integrated services, which maps to Single sign-on (SSO).
Question 3
What is a protocol for querying and modifying directory services containing identities and related attributes?
- Identity proofing
- Ephemeral credential
- OAuth
- LDAP
Correct Answer: D
Correct Answer
Answer D is correct because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. The deciding point is functional fit: this option covers the stated need, while OAuth addresses an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.
Incorrect Answers
Answer A is incorrect because Identity proofing refers to verification of a person’s real-world identity before issuing credentials or establishing an account. That concept can be valid in another scenario, but this question is testing a protocol for querying and modifying directory services containing identities and related attributes; LDAP therefore fits the requirement more directly.
Answer B is incorrect because Ephemeral credential refers to a short-lived credential created for a limited session or task. The key mismatch is functional: LDAP addresses a protocol for querying and modifying directory services containing identities and related attributes, the need stated by the question.
Answer C is incorrect because OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. The concept is valid, but it does not match this stem. The required function is a protocol for querying and modifying directory services containing identities and related attributes, which maps to LDAP.
Question 4
The control set for an identity and privileged-access design review must address both principle of granting only the access required to perform assigned duties and biometric comparison must be combined with authentication of a physical authenticator. The physical authenticator establishes possession, while the biometric comparison supplies an inherence factor. Which TWO choices map directly to those needs? Choose TWO.
- Least privilege
- Multifactor authentication
- A physical authenticator that establishes possession
- LDAP
- Just-in-time permission
Correct Answers: A, C
Correct Answers
Answer A is correct because Least privilege means the principle of granting only the access required to perform assigned duties. This option satisfies a specific requirement in the stem; Multifactor authentication serves authentication using factors from more than one category such as knowledge, possession, or inherence and therefore is not interchangeable with it.
Answer C is correct because A biometric comparison must be combined with authentication of a physical authenticator. The fixed-count item needs this function in the answer set. Just-in-time permission covers temporary elevation granted only when needed and removed automatically after a short period, a different requirement.
Incorrect Answers
Answer B is incorrect because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence. The fixed-count answer set is Least privilege, A physical authenticator that establishes possession; this option does not fill one of those named functions.
Answer D is incorrect because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. Every answer slot must map to a stated requirement. The correct set is Least privilege, A physical authenticator that establishes possession, so this option cannot replace one of those selections.
Answer E is incorrect because Just-in-time permission means temporary elevation granted only when needed and removed automatically after a short period. Every answer slot must map to a stated requirement. The correct set is Least privilege, A physical authenticator that establishes possession, so this option cannot replace one of those selections.
Question 5
To periodically verify that access or compliance assertions are still appropriate, which security approach should be selected?
- Ephemeral credential
- Security key
- Attestation
- Attribute-based access control (ABAC)
Correct Answer: C
Correct Answer
Answer C is correct because Attestation means formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. The requirement maps directly to this function, whereas Ephemeral credential is aimed at a short-lived credential created for a limited session or task.
Incorrect Answers
Answer A is incorrect because Ephemeral credential refers to a short-lived credential created for a limited session or task. The scenario instead requires formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid, which is why Attestation is the better answer; this option serves the different function defined above.
Answer B is incorrect because Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The scenario instead requires formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid, which is why Attestation is the better answer; this option serves the different function defined above.
Answer D is incorrect because Attribute-based access control (ABAC) refers to an access model that evaluates attributes of users, resources, actions, and environment. That concept can be valid in another scenario, but this question is testing formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid; Attestation therefore fits the requirement more directly.
Question 6
Which term describes controlled storage and checkout or brokering of privileged credentials?
- Single sign-on (SSO)
- Ephemeral credential
- Password vaulting
- Just-in-time permission
Correct Answer: C
Correct Answer
Answer C is correct because Password vaulting means controlled storage and checkout or brokering of privileged credentials. The deciding point is functional fit: this option covers the stated need, while Single sign-on (SSO) addresses authentication arrangement that lets a user authenticate once and access multiple integrated services.
Incorrect Answers
Answer A is incorrect because Single sign-on (SSO) refers to authentication arrangement that lets a user authenticate once and access multiple integrated services. That concept can be valid in another scenario, but this question is testing controlled storage and checkout or brokering of privileged credentials; Password vaulting therefore fits the requirement more directly.
Answer B is incorrect because Ephemeral credential refers to a short-lived credential created for a limited session or task. The question is not asking for this function. It is testing controlled storage and checkout or brokering of privileged credentials, so Password vaulting is the stronger fit.
Answer D is incorrect because Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period. This could be appropriate elsewhere, but the required function is controlled storage and checkout or brokering of privileged credentials; that makes Password vaulting the precise choice.
Question 7
Reviewers working through an identity and privileged-access design review identify three separate needs: XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers; access model that evaluates attributes of users, resources, actions, and environment; processes and tools that tightly control, monitor, and audit administrative or high-impact access. Which THREE choices map to those needs? Choose THREE.
- Single sign-on (SSO)
- Biometric factor
- Privileged access management (PAM)
- LDAP
- Attribute-based access control (ABAC)
- SAML
Correct Answers: C, E, F
Correct Answers
Answer C is correct because Privileged access management (PAM) means processes and tools that tightly control, monitor, and audit administrative or high-impact access. The fixed-count item needs this function in the answer set. Biometric factor covers an authentication factor based on a physical or behavioral characteristic of a person, a different requirement.
Answer E is correct because Attribute-based access control (ABAC) means an access model that evaluates attributes of users, resources, actions, and environment. The fixed-count item needs this function in the answer set. LDAP covers a protocol for querying and modifying directory services containing identities and related attributes, a different requirement.
Answer F is correct because SAML means an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers. The fixed-count item needs this function in the answer set. Single sign-on (SSO) covers authentication arrangement that lets a user authenticate once and access multiple integrated services, a different requirement.
Incorrect Answers
Answer A is incorrect because Single sign-on (SSO) means authentication arrangement that lets a user authenticate once and access multiple integrated services. The question requires exactly 3 selections: Privileged access management (PAM), SAML, Attribute-based access control (ABAC). This option falls outside that required set.
Answer B is incorrect because Biometric factor means an authentication factor based on a physical or behavioral characteristic of a person. Every answer slot must map to a stated requirement. The correct set is Privileged access management (PAM), SAML, Attribute-based access control (ABAC), so this option cannot replace one of those selections.
Answer D is incorrect because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. Every answer slot must map to a stated requirement. The correct set is Privileged access management (PAM), SAML, Attribute-based access control (ABAC), so this option cannot replace one of those selections.
Question 8
Which term describes authentication using factors from more than one category such as knowledge, possession, or inherence?
- SAML
- User deprovisioning
- Multifactor authentication
- Least privilege
Correct Answer: C
Correct Answer
Answer C is correct because Multifactor authentication means authentication using factors from more than one category such as knowledge, possession, or inherence. The deciding point is functional fit: this option covers the stated need, while User deprovisioning addresses removal or disabling of accounts and permissions when access is no longer required.
Incorrect Answers
Answer A is incorrect because SAML refers to an XML-based standard commonly used to exchange authentication and authorization assertions between identity providers and service providers. This could be appropriate elsewhere, but the required function is authentication using factors from more than one category such as knowledge, possession, or inherence; that makes Multifactor authentication the precise choice.
Answer B is incorrect because User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required. This could be appropriate elsewhere, but the required function is authentication using factors from more than one category such as knowledge, possession, or inherence; that makes Multifactor authentication the precise choice.
Answer D is incorrect because Least privilege refers to the principle of granting only the access required to perform assigned duties. That concept can be valid in another scenario, but this question is testing authentication using factors from more than one category such as knowledge, possession, or inherence; Multifactor authentication therefore fits the requirement more directly.
Question 9
A review during an identity and privileged-access design review identifies two gaps. One requires processes and tools that tightly control, monitor, and audit administrative or high-impact access. The other requires another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator. Which TWO options should be included in the remediation plan? Choose TWO.
- Privileged access management (PAM)
- A second biometric characteristic without a physical authenticator
- Biometric factor
- Federation
- Security key
Correct Answers: A, B
Correct Answers
Answer A is correct because Privileged access management (PAM) means processes and tools that tightly control, monitor, and audit administrative or high-impact access. One required function is exactly what this option provides. Biometric factor may be useful elsewhere, but it is used for an authentication factor based on a physical or behavioral characteristic of a person.
Answer B is correct because Another biometric characteristic is still an inherence factor and does not establish possession of a physical authenticator. One required function is exactly what this option provides. Biometric factor may be useful elsewhere, but it is used for an authentication factor based on a physical or behavioral characteristic of a person.
Incorrect Answers
Answer C is incorrect because Biometric factor means an authentication factor based on a physical or behavioral characteristic of a person. Every answer slot must map to a stated requirement. The correct set is A second biometric characteristic without a physical authenticator, Privileged access management (PAM), so this option cannot replace one of those selections.
Answer D is incorrect because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials. The required choices are A second biometric characteristic without a physical authenticator, Privileged access management (PAM). Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Security key means a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The question requires exactly 2 selections: A second biometric characteristic without a physical authenticator, Privileged access management (PAM). This option falls outside that required set.
Question 10
To reduce risk from long-lived reusable secrets, which security approach should be selected?
- Ephemeral credential
- Single sign-on (SSO)
- OAuth
- Privileged access management (PAM)
Correct Answer: A
Correct Answer
Answer A is correct because Ephemeral credential means a short-lived credential created for a limited session or task. This is the precise fit for the scenario. OAuth serves the different purpose of an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application.
Incorrect Answers
Answer B is incorrect because Single sign-on (SSO) refers to authentication arrangement that lets a user authenticate once and access multiple integrated services. The concept is valid, but it does not match this stem. The required function is a short-lived credential created for a limited session or task, which maps to Ephemeral credential.
Answer C is incorrect because OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. The concept is valid, but it does not match this stem. The required function is a short-lived credential created for a limited session or task, which maps to Ephemeral credential.
Answer D is incorrect because Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access. That concept can be valid in another scenario, but this question is testing a short-lived credential created for a limited session or task; Ephemeral credential therefore fits the requirement more directly.
Question 11
To minimize standing privileged access, which security approach should be selected?
- OAuth
- Mandatory access control (MAC)
- Password vaulting
- Just-in-time permission
Correct Answer: D
Correct Answer
Answer D is correct because Just-in-time permission means temporary elevation granted only when needed and removed automatically after a short period. The requirement maps directly to this function, whereas Password vaulting is aimed at controlled storage and checkout or brokering of privileged credentials.
Incorrect Answers
Answer A is incorrect because OAuth refers to an authorization framework that lets a user grant an application limited access to a resource without sharing the user’s password with that application. The concept is valid, but it does not match this stem. The required function is temporary elevation granted only when needed and removed automatically after a short period, which maps to Just-in-time permission.
Answer B is incorrect because Mandatory access control (MAC) refers to an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. The question is not asking for this function. It is testing temporary elevation granted only when needed and removed automatically after a short period, so Just-in-time permission is the stronger fit.
Answer C is incorrect because Password vaulting refers to controlled storage and checkout or brokering of privileged credentials. The scenario instead requires temporary elevation granted only when needed and removed automatically after a short period, which is why Just-in-time permission is the better answer; this option serves the different function defined above.
Question 12
To access directory information used by enterprise identity systems, which security approach should be selected?
- Biometric factor
- LDAP
- Hardware token
- User deprovisioning
Correct Answer: B
Correct Answer
Answer B is correct because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. This is the precise fit for the scenario. User deprovisioning serves the different purpose of removal or disabling of accounts and permissions when access is no longer required.
Incorrect Answers
Answer A is incorrect because Biometric factor refers to an authentication factor based on a physical or behavioral characteristic of a person. This could be appropriate elsewhere, but the required function is a protocol for querying and modifying directory services containing identities and related attributes; that makes LDAP the precise choice.
Answer C is incorrect because Hardware token refers to a physical device that generates, stores, or proves possession of authentication material. The concept is valid, but it does not match this stem. The required function is a protocol for querying and modifying directory services containing identities and related attributes, which maps to LDAP.
Answer D is incorrect because User deprovisioning refers to removal or disabling of accounts and permissions when access is no longer required. The key mismatch is functional: LDAP addresses a protocol for querying and modifying directory services containing identities and related attributes, the need stated by the question.
Question 13
Which term describes software that securely stores and often generates unique credentials?
- Single sign-on (SSO)
- Password manager
- Ephemeral credential
- User provisioning
Correct Answer: B
Correct Answer
Answer B is correct because Password manager means software that securely stores and often generates unique credentials. The deciding point is functional fit: this option covers the stated need, while Ephemeral credential addresses a short-lived credential created for a limited session or task.
Incorrect Answers
Answer A is incorrect because Single sign-on (SSO) refers to authentication arrangement that lets a user authenticate once and access multiple integrated services. The key mismatch is functional: Password manager addresses software that securely stores and often generates unique credentials, the need stated by the question.
Answer C is incorrect because Ephemeral credential refers to a short-lived credential created for a limited session or task. That concept can be valid in another scenario, but this question is testing software that securely stores and often generates unique credentials; Password manager therefore fits the requirement more directly.
Answer D is incorrect because User provisioning refers to creation and assignment of accounts, attributes, groups, and access for an identity. The concept is valid, but it does not match this stem. The required function is software that securely stores and often generates unique credentials, which maps to Password manager.
Question 14
To enforce strict system-controlled information-flow rules, which security approach should be selected?
- Attestation
- Privileged access management (PAM)
- Just-in-time permission
- Mandatory access control (MAC)
Correct Answer: D
Correct Answer
Answer D is correct because Mandatory access control (MAC) means an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. That is the function the question is testing. Privileged access management (PAM) would instead be used for processes and tools that tightly control, monitor, and audit administrative or high-impact access.
Incorrect Answers
Answer A is incorrect because Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. This could be appropriate elsewhere, but the required function is an access model in which centrally defined labels and policy determine access and users cannot freely change permissions; that makes Mandatory access control (MAC) the precise choice.
Answer B is incorrect because Privileged access management (PAM) refers to processes and tools that tightly control, monitor, and audit administrative or high-impact access. The key mismatch is functional: Mandatory access control (MAC) addresses an access model in which centrally defined labels and policy determine access and users cannot freely change permissions, the need stated by the question.
Answer C is incorrect because Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period. The question is not asking for this function. It is testing an access model in which centrally defined labels and policy determine access and users cannot freely change permissions, so Mandatory access control (MAC) is the stronger fit.
Question 15
During an identity and privileged-access design review, the team has two independent requirements: (1) trust arrangement that lets identities from one security domain access resources in another without separate local credentials; and (2) password supplies a knowledge factor but does not establish possession of the physical authenticator required by the cited guidance. Which TWO choices best satisfy those requirements? Choose TWO.
- Least privilege
- Attribute-based access control (ABAC)
- Federation
- A password as the only additional mechanism
- Security key
Correct Answers: C, D
Correct Answers
Answer C is correct because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials. This selection maps directly to one of the named needs. Attribute-based access control (ABAC) addresses an access model that evaluates attributes of users, resources, actions, and environment, so it does not satisfy the same slot.
Answer D is correct because A password supplies a knowledge factor but does not establish possession of the physical authenticator required by the cited guidance. This selection maps directly to one of the named needs. Least privilege addresses the principle of granting only the access required to perform assigned duties, so it does not satisfy the same slot.
Incorrect Answers
Answer A is incorrect because Least privilege means the principle of granting only the access required to perform assigned duties. The required choices are A password as the only additional mechanism, Federation. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer B is incorrect because Attribute-based access control (ABAC) means an access model that evaluates attributes of users, resources, actions, and environment. The question requires exactly 2 selections: A password as the only additional mechanism, Federation. This option falls outside that required set.
Answer E is incorrect because Security key means a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The scenario calls for A password as the only additional mechanism, Federation. Selecting this option would leave one of those required functions uncovered.
Question 16
What is an access model in which centrally defined labels and policy determine access and users cannot freely change permissions?
- Mandatory access control (MAC)
- Passwordless authentication
- Password vaulting
- Just-in-time permission
Correct Answer: A
Correct Answer
Answer A is correct because Mandatory access control (MAC) means an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. This matches the requirement as written. Passwordless authentication can be valid in another context, but it is used for authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics.
Incorrect Answers
Answer B is incorrect because Passwordless authentication refers to authentication designed to avoid a reusable memorized password, often using device-bound cryptographic credentials or biometrics. This could be appropriate elsewhere, but the required function is an access model in which centrally defined labels and policy determine access and users cannot freely change permissions; that makes Mandatory access control (MAC) the precise choice.
Answer C is incorrect because Password vaulting refers to controlled storage and checkout or brokering of privileged credentials. This could be appropriate elsewhere, but the required function is an access model in which centrally defined labels and policy determine access and users cannot freely change permissions; that makes Mandatory access control (MAC) the precise choice.
Answer D is incorrect because Just-in-time permission refers to temporary elevation granted only when needed and removed automatically after a short period. The question is not asking for this function. It is testing an access model in which centrally defined labels and policy determine access and users cannot freely change permissions, so Mandatory access control (MAC) is the stronger fit. This question specifically tests the requirement represented by Mandatory access control (MAC).
Question 17
A review during an identity and privileged-access design review identifies two gaps. One requires trust arrangement that lets identities from one security domain access resources in another without separate local credentials. The other requires personal knowledge answer does not authenticate a physical authenticator or establish possession. Which TWO options should be included in the remediation plan? Choose TWO.
- User deprovisioning
- LDAP
- Hardware token
- Federation
- An answer to a personal knowledge question
Correct Answers: D, E
Correct Answers
Answer D is correct because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials. This selection maps directly to one of the named needs. LDAP addresses a protocol for querying and modifying directory services containing identities and related attributes, so it does not satisfy the same slot.
Answer E is correct because A personal knowledge answer does not authenticate a physical authenticator or establish possession. This option satisfies a specific requirement in the stem; LDAP serves a protocol for querying and modifying directory services containing identities and related attributes and therefore is not interchangeable with it.
Incorrect Answers
Answer A is incorrect because User deprovisioning means removal or disabling of accounts and permissions when access is no longer required. The scenario calls for Federation, An answer to a personal knowledge question. Selecting this option would leave one of those required functions uncovered.
Answer B is incorrect because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. The fixed-count answer set is Federation, An answer to a personal knowledge question; this option does not fill one of those named functions.
Answer C is incorrect because Hardware token means a physical device that generates, stores, or proves possession of authentication material. The required choices are Federation, An answer to a personal knowledge question. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 18
As part of an identity and privileged-access design review, reviewers identify a need for authentication factor based on a physical or behavioral characteristic of a person. Which option should they select?
- Just-in-time permission
- Biometric factor
- Password vaulting
- User provisioning
Correct Answer: B
Correct Answer
Answer B is correct because Biometric factor means an authentication factor based on a physical or behavioral characteristic of a person. The requirement maps directly to this function, whereas Password vaulting is aimed at controlled storage and checkout or brokering of privileged credentials.
Incorrect Answers
Answer A is incorrect because Just-in-time permission means temporary elevation granted only when needed and removed automatically after a short period. That concept can be valid in another scenario, but this question is testing an authentication factor based on a physical or behavioral characteristic of a person; Biometric factor therefore fits the requirement more directly.
Answer C is incorrect because Password vaulting means controlled storage and checkout or brokering of privileged credentials. This could be appropriate elsewhere, but the required function is an authentication factor based on a physical or behavioral characteristic of a person; that makes Biometric factor the precise choice.
Answer D is incorrect because User provisioning means creation and assignment of accounts, attributes, groups, and access for an identity. That concept can be valid in another scenario, but this question is testing an authentication factor based on a physical or behavioral characteristic of a person; Biometric factor therefore fits the requirement more directly.
Question 19
What is the principle of granting only the access required to perform assigned duties?
- Least privilege
- Attestation
- Security key
- Discretionary access control (DAC)
Correct Answer: A
Correct Answer
Answer A is correct because Least privilege means the principle of granting only the access required to perform assigned duties. The deciding point is functional fit: this option covers the stated need, while Discretionary access control (DAC) addresses an access model in which resource owners can grant or modify access permissions. This question specifically tests the requirement represented by Least privilege.
Incorrect Answers
Answer B is incorrect because Attestation refers to formal confirmation that an identity, device, access assignment, or security state has been reviewed and remains valid. The concept is valid, but it does not match this stem. The required function is the principle of granting only the access required to perform assigned duties, which maps to Least privilege.
Answer C is incorrect because Security key refers to a hardware authenticator that performs cryptographic challenge-response for supported authentication protocols. The key mismatch is functional: Least privilege addresses the principle of granting only the access required to perform assigned duties, the need stated by the question. This question specifically tests the requirement represented by Least privilege.
Answer D is incorrect because Discretionary access control (DAC) refers to an access model in which resource owners can grant or modify access permissions. The key mismatch is functional: Least privilege addresses the principle of granting only the access required to perform assigned duties, the need stated by the question.
Question 20
Two requirements remain open in an identity and privileged-access design review: creation and assignment of accounts, attributes, groups, and access for an identity; trust arrangement that lets identities from one security domain access resources in another without separate local credentials. Which TWO options close those specific gaps? Choose TWO.
- User provisioning
- Just-in-time permission
- Federation
- LDAP
- Mandatory access control (MAC)
Correct Answers: A, C
Correct Answers
Answer A is correct because User provisioning means creation and assignment of accounts, attributes, groups, and access for an identity. This selection maps directly to one of the named needs. Mandatory access control (MAC) addresses an access model in which centrally defined labels and policy determine access and users cannot freely change permissions, so it does not satisfy the same slot.
Answer C is correct because Federation means trust arrangement that lets identities from one security domain access resources in another without separate local credentials. The fixed-count item needs this function in the answer set. LDAP covers a protocol for querying and modifying directory services containing identities and related attributes, a different requirement.
Incorrect Answers
Answer B is incorrect because Just-in-time permission means temporary elevation granted only when needed and removed automatically after a short period. The question requires exactly 2 selections: User provisioning, Federation. This option falls outside that required set. For example, Federation is required for trust arrangement that lets identities from one security domain access resources in another without separate local credentials.
Answer D is incorrect because LDAP means a protocol for querying and modifying directory services containing identities and related attributes. Every answer slot must map to a stated requirement. The correct set is User provisioning, Federation, so this option cannot replace one of those selections.
Answer E is incorrect because Mandatory access control (MAC) means an access model in which centrally defined labels and policy determine access and users cannot freely change permissions. The scenario calls for User provisioning, Federation. Selecting this option would leave one of those required functions uncovered.
