4 Identity and Access Management Online Quiz Questions

True or false: Successfully authenticating to a company portal automatically authorizes an account to view every company resource.

A document owner chooses which colleagues can open a particular file and can later revoke their access. Which access-control model best describes this decision?

What is the minimum number of distinct authentication factors required for multifactor authentication (MFA)? Enter the number as an integer.

A system checks a security key to verify that a user controls a claimed account. Which access-decision step is the system performing?

A policy uses attribute-based access control (ABAC). Which categories may it evaluate when deciding whether to allow a request? Select all that apply.

True or false: A one-time code is phishing-resistant because a fake sign-in site cannot relay it to the real service.

One employee creates a payment and another employee approves it, so neither person can complete the entire sensitive process alone. What security principle does this illustrate?

An employee leaves an organization, and the account is no longer needed. What is the appropriate account-lifecycle action?

Which practices help protect accounts and their recovery paths? Select all that apply.

A system records a user's actions so investigators can review them later. Which access-decision step does this describe?

A support specialist needs to reset employee passwords and occasionally perform an administrator-only maintenance task. Describe how an organization should provision and manage this person's access to limit the impact of mistakes or compromise.

True or false: A password manager should be protected with a strong master password and multifactor authentication.

A system uses a centrally enforced policy to compare security labels on documents with users' clearances. Users cannot freely change the policy. Which access-control model is this?

A password used for one service is exposed in a breach. Which practice best limits an attacker’s ability to use that password to access other services?

An automated program only needs to read customer records. Which permission assignment best follows least privilege?

An employee moves from the billing team to a role that does not involve invoices. What should an administrator do about the employee’s billing permissions?

Name one phishing-resistant authentication method the material recommends preferring when available.

A clinician may view a patient record only if assigned to that patient and using an approved device. Which access-control model evaluates attributes such as the user, resource, and device?