(ISC)² CISSP Identity and Access Management Practice Questions

Free CISSP Identity and Access Management practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main (ISC)² CISSP page. Sign up free to practice the full set.

1. Question 1Identity and Access Management

   What is the principle of least privilege?

   • AGranting broad administrative rights to speed up help-desk support
   • BProvisioning one shared account for an entire team's convenience
   • CGranting subjects only the minimum access needed to perform their functionCorrect
   • DAssigning identical permission sets to every role for consistency
   ✓ Correct answer: C

   The Principle of Least Privilege grants users the minimum permissions necessary to perform their job functions. Implementing least privilege requires regular access reviews, removal of unnecessary permissions, and role-based access control (RBAC) implementation. Administrative and system access must be restricted to authorized personnel only. Least privilege reduces the impact if a user account is compromised. Periodic access reviews ensure permissions align with current job responsibilities.

   Why the other options are wrong

   • ABroad admin rights grant far more access than a role requires, violating least privilege.
   • BA shared account over-provisions everyone and breaks individual accountability.
   • DUniform permissions ignore each role's actual needs and grant excess access.
2. Question 2Identity and Access Management

   An architect chooses between OAuth 2.0 and SAML for a new design. Which selection reflects correct intended use?

   • AUse either OAuth or SAML interchangeably since both are designed for the very same purpose
   • BUse OAuth 2.0 for delegated authorization and SAML for web SSO authentication assertionsCorrect
   • CUse SAML to issue bearer-style tokens for granular, fine-grained API authorization scopes
   • DUse OAuth 2.0 alone because it is an authentication protocol that proves user identity by itself
   ✓ Correct answer: B

   OAuth 2.0 is an authorization framework: it issues access tokens so an application can act on a resource owner's behalf without handling credentials, but it does not by itself prove identity. SAML is an XML-based assertion standard built for exchanging authentication statements between an identity provider and service provider, making it the traditional choice for enterprise web SSO. Correct architecture pairs OAuth for delegated API authorization with SAML for authentication assertions.

   Why the other options are wrong

   • ATreating OAuth and SAML as interchangeable ignores that one solves authorization and the other authentication.
   • CSAML issues assertions, not OAuth-style bearer tokens, so it is not built for granular API scopes.
   • DOAuth 2.0 alone conveys no identity claim; it authorizes access without authenticating the user.
3. Question 3Identity and Access Management

   Which authorization model is MOST appropriate when access decisions must combine the subject's department, the resource's classification, and the time of day at request evaluation?

   • AMandatory Access Control (MAC)
   • BRole-Based Access Control (RBAC)
   • CDiscretionary Access Control (DAC)
   • DAttribute-Based Access Control (ABAC)Correct
   ✓ Correct answer: D

   Attribute-Based Access Control (ABAC) evaluates access at request time using policies that combine subject attributes (department), resource attributes (classification), and environment attributes (time of day). Because the decision depends on multiple dynamic, contextual conditions rather than a fixed assignment, ABAC is the model built to express this kind of fine-grained, multi-attribute policy.

   Why the other options are wrong

   • AMAC enforces access through clearance-versus-classification labels and cannot natively factor in attributes like department or time of day.
   • BRBAC grants access based on assigned roles and has no built-in support for dynamic conditions such as time of day.
   • CDAC lets owners set permissions at their own discretion and does not centrally combine subject, resource, and context in one policy.
4. Question 4Identity and Access ManagementSelect all that apply

   Which TWO measures most directly reduce the impact of session-hijacking attacks against authenticated web sessions? (Choose TWO)

   • ASetting session cookies with the Secure and HttpOnly attributesCorrect
   • BRegenerating the session identifier upon successful authentication and privilege changeCorrect
   • CIncreasing the session inactivity timeout to several days for convenience
   • DStoring the session identifier in the URL query string
   ✓ Correct answer: A, B

   Marking cookies Secure ensures they traverse only encrypted channels, and HttpOnly blocks script access that could steal the token via XSS. Regenerating the session identifier at authentication and privilege transitions defeats session fixation and limits the value of any previously captured identifier. Together these directly shrink hijacking exposure.

   Why the other options are wrong

   • CLengthening inactivity timeouts widens the window an attacker can reuse a stolen session, increasing risk.
   • DPlacing session IDs in URLs exposes them in logs, history, and referrers, making hijacking easier rather than harder.
5. Question 5Identity and Access Management

   An access decision must evaluate the subject's clearance, the resource's classification, the time of day, and the requesting device's compliance state in a single policy. Which authorization model is best suited?

   • AAttribute-Based Access Control (ABAC)Correct
   • BRole-Based Access Control (RBAC)
   • CRule-based access control limited to static firewall ACLs
   • DDiscretionary Access Control (DAC)
   ✓ Correct answer: A

   ABAC composes access rules from arbitrary attributes such as clearance, classification, time, and device posture, enabling fine-grained, dynamic decisions in one policy engine. This flexibility is exactly what the scenario requires. RBAC alone cannot natively incorporate environmental context like time of day or device compliance.

   Why the other options are wrong

   • BRBAC maps permissions to roles and cannot natively combine environmental attributes like time or device state.
   • CStatic firewall ACLs operate on network parameters, not rich subject/resource/environment attribute policies.
   • DDAC delegates access to object owners and is not designed for multi-attribute, context-aware evaluation.
6. Question 6Identity and Access Management

   Two analysts both hold Top Secret clearance. One is assigned to a counter-narcotics program and the other to a cyber program. Policy prevents each from reading the other program's documents even though both are cleared at the same level. Which principle MOST directly explains this restriction?

   • ANeed-to-knowCorrect
   • BSeparation of duties
   • CLeast privilege applied to administrative rights
   • DMandatory vacation
   ✓ Correct answer: A

   Clearance level establishes the maximum sensitivity a person may access, but need-to-know further limits access to only the information necessary to perform assigned duties. Both analysts are cleared to Top Secret, yet each lacks a need to know the other program's material, so access is compartmentalized. This is the classic distinction between clearance and need-to-know in mandatory environments.

   Why the other options are wrong

   • BSeparation of duties splits a sensitive process across people to prevent fraud; it is not about compartmentalizing program information among equally cleared analysts.
   • CLeast privilege as applied to admin rights concerns limiting elevated capabilities, not restricting peer access to program documents by topic.
   • DMandatory vacation is a detective control to surface fraud, unrelated to compartmenting document access.
7. Question 7Identity and Access ManagementSelect all that apply

   A financial firm is deploying a privileged access management (PAM) solution for administrators. Which TWO capabilities are core to PAM and BEST reduce the risk of privileged-credential abuse? (Choose two.)

   • AVaulting and automatic rotation of privileged account passwords so admins do not know or persistently hold the static credentialCorrect
   • BSession recording and monitoring of privileged sessions for accountability and detectionCorrect
   • CAllowing administrators to share one common root password to simplify access
   • DDisabling all logging on privileged sessions to improve performance
   ✓ Correct answer: A, B

   PAM centralizes and protects privileged credentials by vaulting them and rotating them automatically, so admins check out access without permanently knowing static passwords, limiting reuse and theft value. It also records and monitors privileged sessions, providing accountability and detection of misuse. These two capabilities directly target the elevated risk that privileged accounts pose.

   Why the other options are wrong

   • CShared static root passwords destroy individual accountability and increase abuse risk - the opposite of what PAM enforces.
   • DDisabling privileged-session logging removes the very accountability and detection PAM is meant to provide.
8. Question 8Identity and Access Management

   A security review finds an application authenticating to a database with a generic 'app_svc' account whose password is hardcoded in config, shared across three teams, and never rotated. Which characteristic makes this account the GREATEST accountability concern?

   • AIt is a service account, so it inherently and automatically supports MFA
   • BIt is a shared account, so individual actions can never be attributedCorrect
   • CIt is a default account that was originally shipped by the vendor
   • DIt is a privileged account that simply requires a longer password
   ✓ Correct answer: B

   Because multiple teams use the same credential, no log can tie an action to a specific person, destroying individual accountability and non-repudiation. Shared and service accounts should be minimized, checked out through a vault, rotated, and where possible replaced with per-workload managed identities. The shared nature is the core governance failure in this scenario.

   Why the other options are wrong

   • AService accounts do not inherently support MFA; that framing is false and not the concern raised.
   • CNothing indicates it is a vendor default; the described problem is shared, static usage.
   • DPassword length is a secondary hardening detail, not the accountability failure of a shared credential.

How Identity and Access Management is tested

This domain holds 138 of the 1,117 questions in the CISSP bank, about 12%. The mix is 116 single-answer multiple choice and 22 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Identity and Access Management on its own rather than re-running full-length mocks.

Other CISSP exam domains

• Security and Risk Management172 questions
• Asset Security109 questions
• Security Architecture and Engineering141 questions
• Communication and Network Security138 questions
• Security Assessment and Testing130 questions
• Security Operations157 questions
• Software Development Security132 questions
• All CISSP practice questions1,117 total
• Identity and Access Management study notesKey concepts
• Security practice examsAll Security

CISSP Identity and Access Management FAQ