4 Identity, Access, and Cryptography Online Quiz Questions

A user successfully signs in to a company portal but cannot view payroll records. This can happen because authentication succeeded while authorization did not grant access to those records.

What term describes authenticating once to an identity provider and then accessing multiple connected services without separately entering credentials at each service?

A document's owner decides which colleagues can access it by changing its access-control list. Which access-control model does this scenario illustrate?

SFTP transfers files over SSH.

Select all combinations that use two different authentication factor types and therefore meet the definition of multi-factor authentication.

What does a digital certificate establish about a website's identity and cryptographic keys?

Which protocol protects IP-layer communications and is commonly used for VPNs?

When validating a certificate for a service, which checks are appropriate? Select all that apply.

An SSH client reports that a server's host key has unexpectedly changed. What is the safest response?

Which approach best reflects privileged access management for high-impact administrator permissions?

If an expected digest is trusted, comparing it with a cryptographic hash of received data can reveal changes; by itself, the plain hash does not authenticate who created the data.

Compare a plain cryptographic hash, a message authentication code (MAC), and a digital signature. For each, explain how it is produced, what security properties it supports, and one important limitation or distinction from the other mechanisms.

An employee successfully signs in to a company portal, but the system blocks access to payroll records because the employee lacks permission. Which IAM function makes that access decision?

A staff member needs to view invoices to perform their job, but does not need permission to issue refunds. What access-control principle supports granting only the permissions needed for the assigned work?

A health system permits a clinician to view a patient's record only if the clinician is assigned to that patient and is using an approved device. Which access-control model best describes this policy?

An organization wants an MFA sign-in that combines two different authentication factor types. Which option meets that requirement?

What is the name of the mechanism that distributes a list of revoked certificates?

A website presents a certificate that chains to a trusted CA and is within its validity period, but the certificate name does not match the website the user intended to visit. What should the user conclude?