Examius
🇺🇸 Certified Information Systems Security Professional (CISSP) · flashcards
Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM) Flashcards
51 question-and-answer cards covering Identity and Access Management (IAM) as it is examined in Certified Information Systems Security Professional (CISSP). 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.
24 sample cards from the Identity and Access Management (IAM) deck
Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.
What is non-repudiation and how is it supported in IAM?
Non-repudiation ensures a subject cannot deny having performed an action. It is supported by strong authentication, unique accounts (no shared accounts), audit logs, and digital signatures.
What is the purpose of audit trails and logging in accountability?
They record who did what, when, and where, enabling detection of misuse, reconstruction of events, investigation, and enforcement of non-repudiation. Logs must be protected from tampering.
What is clipping level in the context of auditing?
A predefined threshold of acceptable activity (e.g., number of failed logins) below which events are not flagged. Exceeding the clipping level triggers an alert or response.
What is the difference between authentication and Single Sign-On (SSO)?
Authentication verifies identity for a resource. SSO lets a user authenticate once and gain access to multiple independent systems without re-authenticating, using a shared session/token.
What is a key advantage and a key disadvantage of Single Sign-On (SSO)?
Advantage: improved user convenience and centralized authentication management. Disadvantage: a single point of failure/compromise - one set of stolen credentials can unlock all linked systems.
What is federated identity management?
An arrangement where multiple organizations (trust domains) share identity information so users authenticated in one domain can access resources in another, without separate credentials. It extends SSO across organizational boundaries.
What is SAML and what is it used for?
Security Assertion Markup Language - an XML-based open standard for exchanging authentication and authorization assertions between an Identity Provider (IdP) and a Service Provider (SP). It is widely used for web-based SSO and federation.
In SAML, what are the roles of the Identity Provider (IdP), Service Provider (SP), and Principal?
The Principal is the user. The IdP authenticates the user and issues assertions. The SP (relying party) consumes the assertion and provides the requested resource/service.
What is OAuth 2.0 primarily designed for?
OAuth 2.0 is an authorization framework that lets a third-party application obtain delegated, limited access to a user's resources via access tokens, without sharing the user's credentials. It handles authorization, not authentication.
What is OpenID Connect (OIDC)?
An authentication layer built on top of OAuth 2.0 that adds an ID token (JWT), enabling federated authentication/SSO. OAuth handles authorization; OIDC adds identity verification.
How does Kerberos provide authentication, and what tickets does it use?
Kerberos uses a trusted third-party Key Distribution Center (KDC) with symmetric-key cryptography. The Authentication Server issues a Ticket Granting Ticket (TGT); the Ticket Granting Service then issues service tickets for specific resources, enabling SSO.
What are the main components of the Kerberos KDC?
The Authentication Server (AS), which verifies users and issues the TGT, and the Ticket Granting Service (TGS), which issues service tickets. Together they form the KDC holding all secret keys.
What is a primary weakness of Kerberos?
The KDC is a single point of failure and a high-value target; if compromised, all keys are exposed. Kerberos also requires reasonably synchronized clocks (tickets are time-stamped) and is vulnerable to offline password guessing on TGTs.
What is LDAP and what is it used for in IAM?
Lightweight Directory Access Protocol - a protocol for querying and modifying directory services that store identity, account, and resource information in a hierarchical tree. It underpins centralized authentication directories like Active Directory.
What is RADIUS and what authentication scenario does it serve?
Remote Authentication Dial-In User Service - a centralized AAA protocol commonly used for network access (VPN, Wi-Fi, dial-up). It combines authentication and authorization and uses UDP, encrypting only the password.
How does TACACS+ differ from RADIUS?
TACACS+ uses TCP, encrypts the entire packet payload (not just the password), and separates Authentication, Authorization, and Accounting into independent processes. RADIUS uses UDP and combines authn/authz. TACACS+ is favored for device administration.
What is Identity as a Service (IDaaS)?
A cloud-based subscription model that delivers identity and access management functions (SSO, MFA, provisioning, directory, federation) as a service, offloading IAM infrastructure to a third-party provider.
What is SCIM and what problem does it solve?
System for Cross-domain Identity Management - an open standard (REST/JSON) for automating the exchange of user identity information between identity domains, especially provisioning and deprovisioning of accounts across cloud applications.
What is Just-In-Time (JIT) provisioning in federated/cloud IAM?
Automatically creating a user account at the service provider on the user's first login, using attributes from the identity provider's assertion, eliminating the need to pre-provision accounts.
In a federated trust, what is the difference between transitive and non-transitive trust?
Transitive trust extends: if A trusts B and B trusts C, then A trusts C. Non-transitive trust does not extend beyond the directly established relationship; A would not automatically trust C.
What is the difference between a Type 1 and Type 2 error's security impact in access control terms?
A Type II error (false acceptance) lets an unauthorized subject in - a security breach. A Type I error (false rejection) merely inconveniences a legitimate user. Security-wise, minimizing Type II is the priority.
What is session management and why is it important in IAM?
Controlling the lifecycle of an authenticated session, including timeouts, idle lockouts, re-authentication, and secure session token handling. It limits exposure from unattended or hijacked sessions, especially critical with SSO.
What is a one-time password (OTP) and what are its two common generation methods?
An OTP is a password valid for a single login/session. It is generated either time-based (TOTP, tied to synchronized clocks) or HMAC/event-based (HOTP, tied to an incrementing counter).
What is the difference between a subject and an object in access control?
A subject is the active entity requesting access (user, process, program). An object is the passive entity being accessed (file, database, device). Access controls mediate what subjects may do to objects.
What this deck covers
The Identity and Access Management (IAM) deck follows the Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM) syllabus — 3 chapters and 10 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 17.0 cards per chapter.
Answers are written to be recallable, not just readable — averaging about 211 characters, which is long enough to carry the reasoning and short enough to say out loud.
A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.
Identity and Access Management (IAM) flashcards FAQ
How many Identity and Access Management (IAM) flashcards are in this Certified Information Systems Security Professional (CISSP) deck?
51 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.
Are these Certified Information Systems Security Professional (CISSP) flashcards free?
Yes. The preview here is free to read with no signup, and the full 51-card deck is free inside the Examius app.
What do the Identity and Access Management (IAM) cards cover?
They follow the Certified Information Systems Security Professional (CISSP) Identity and Access Management (IAM) syllabus — 3 chapters and 10 topics — so the questions track what is actually examinable.
How should I use these flashcards?
Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.