CISSP Domain 5 Identity And Access Management Practice Test 100 Questions

CISSP DOMAIN 5 IDENTITY

AND ACCESS

MANAGEMENT PRACTICE

TEST 100 QUESTIONS

Question 1: A company wants to reduce the chance that a stolen proximity badge

alone can be used to enter its data center after business hours. Which control BEST addresses this risk?

Choices:

1) Require a badge plus a PIN at the data center entrance 2) Increase the badge read range 3) Allow guards to visually recognize frequent visitors 4) Issue identical spare badges to each team

Correct Answer: Require a badge plus a PIN at the data center entrance

Explanation: Requiring both a badge and a PIN combines a possession factor with a knowledge factor. A stolen badge alone would therefore be insu�cient for entry.Page 1

Question 2: A research repository contains projects that are all classi�ed at the same sensitivity level, but users should see only projects they are assigned to.Which principle is MOST important in deciding access?

Choices:

1) Availability 2) Nonrepudiation 3) Data remanence 4) Need to know

Correct Answer: Need to know

Explanation: Need to know limits access to information to users whose job responsibilities require that speci�c information, even when they otherwise hold an appropriate clearance or role.

Question 3: An API gateway must authenticate an automated billing process that

runs without a human user. What type of identity should be used?

Choices:

1) An anonymous guest identity 2) The personal account of the application developer 3) A named service identity dedicated to the billing process 4) A shared employee account

Correct Answer: A named service identity dedicated to the billing process

Explanation: A dedicated service identity provides a distinct nonhuman identity that can be granted only the permissions required by the process and can be audited independently.Page 2

Question 4: Security discovers that employees regularly hold a secure door open for coworkers who have not presented credentials. Which control would BEST reduce this exposure?

Choices:

1) More complex workstation passwords 2) An anti-passback or mantrap design that requires each person to authenticate 3) Longer badge expiration periods 4) A larger visitor lobby

Correct Answer: An anti-passback or mantrap design that requires each person to

authenticate Explanation: Controls that force each individual to authenticate at the physical boundary directly address tailgating and piggybacking. Workstation password settings do not correct the physical access weakness.

Question 5: A company allows only managed laptops with current endpoint

protection to connect to an internal administrative network. Which access decision input is being emphasized?

Choices:

1) Data ownership 2) Password history 3) User job title only 4) Device security posture

Correct Answer: Device security posture

Explanation: Device security posture evaluates the condition and trustworthiness of the endpoint, such as management state and security controls, before granting network access.Page 3