Unit 2: Implement Identity and Access Management, Secure Enterprise Network Architecture - Practice Quiz

1 What does authentication primarily verify?

2 Which of the following is an example of a "something you have" authentication factor?

3 What does the acronym MFA stand for?

4 A biometric authentication method is based on which factor type?

5 What does authorization determine after a user is authenticated?

6 In Role-Based Access Control (RBAC), permissions are assigned based on what?

7 Which security principle states that users should be given only the access they need to do their job?

8 What is an Access Control List (ACL) used for?

9 What does SSO (Single Sign-On) allow a user to do?

10 Which protocol is commonly used to query and manage directory information such as users and groups?

11 What does the term provisioning refer to in identity management?

12 What is federated identity?

13 What is the purpose of a DMZ in network architecture?

14 What does network segmentation help achieve?

15 What is a VLAN?

16 What is the main function of a firewall?

17 What does an IDS (Intrusion Detection System) primarily do?

18 How does an IPS (Intrusion Prevention System) differ from an IDS?

19 Which protocol secures web traffic by encrypting data between a browser and a server?

20 What does a VPN provide for remote users?

21 A banking app requires users to enter a password and then approve a push notification on their registered phone. Which authentication model does this represent?

22 An organization wants users to log in once and access multiple cloud services without re-entering credentials, while keeping passwords stored only at the identity provider. Which protocol is most appropriate?

23 A system stores passwords by applying a one-way hash with a unique random value added to each password before hashing. What is the primary purpose of adding that random value?

24 A hospital system grants permissions based on job titles such as Nurse, Doctor, and Administrator, assigning each title a predefined set of rights. Which access control model is in use?

25 In a system using the principle of least privilege, a new intern needs read access to only one shared folder. Which approach best follows this principle?

26 A cloud policy grants access only if a request comes from a corporate device, during business hours, and from a specific country. Which access control model evaluates multiple such characteristics together?

27 A file owner in an operating system can decide which other users may read or modify their files, and can pass that ability on. Which access control model does this describe?

28 An enterprise automatically creates user accounts in email, HR, and VPN systems the moment a new employee is added to the central directory, and disables them on termination. This lifecycle process is known as:

29 A university lets students use their campus credentials to log in to a partner library's online portal without creating a new account there. What identity concept enables this cross-organization trust?

30 A security auditor finds several accounts with elevated rights accumulated from past projects that are no longer needed. What is this condition called, and what practice corrects it?

31 Which directory protocol is most commonly used to query and manage identity information such as users and groups in an enterprise directory service?

32 A company places its public web and mail servers in a network segment isolated from the internal LAN but reachable from the internet. What is this segment called?

33 An administrator divides one physical switch into separate logical networks for Finance and Engineering so their traffic is isolated without extra hardware. Which technology achieves this?

34 A security team designs the network so that even internal users must be authenticated and authorized for every resource request, with no implicit trust based on network location. This design philosophy is called:

35 Why is network segmentation considered an effective defense against the lateral movement of an attacker who has compromised one host?

36 A security appliance monitors network traffic, detects malicious patterns, and actively blocks or drops offending packets in real time. Which device is this?

37 An organization deploys a device that inspects traffic at the application layer, integrates intrusion prevention, performs deep packet inspection, and enforces user-identity-aware policies. Which appliance best fits this description?

38 A traditional stateful firewall differs from a stateless packet filter primarily because it:

39 A website migrates from HTTP to HTTPS. Which protocol provides the encryption and server authentication that secures the HTTPS session?

40 A remote employee connects to the corporate network over the public internet through an encrypted tunnel that makes their device appear as if it is on the internal LAN. What technology provides this secure encrypted tunnel across the untrusted internet while keeping the data confidential?

41 An organization implements a time-based one-time password (TOTP) system using with a 30-second step. A user in a timezone 5 hours ahead of UTC repeatedly fails authentication despite entering correct codes. The server validates against UTC. What is the MOST likely root cause?

42 A system uses Attribute-Based Access Control (ABAC) with the policy: permit if AND . A user with clearance 3 and department "Finance" is denied access to a resource classified at level 2 owned by "Finance". Which explanation is MOST consistent with correct ABAC evaluation?

43 In a federated identity setup using SAML 2.0, an attacker intercepts and replays a valid, properly signed SAML assertion to gain access to a Service Provider. Which assertion element, when properly validated, MOST directly prevents this replay?

44 A network architect designs a three-tier DMZ where web servers must reach application servers, which must reach database servers, but no direct web-to-database path may exist. During a review, a flat VLAN is discovered connecting all three tiers with ACLs enforcing the restrictions. What is the PRIMARY architectural weakness of this approach?

45 A next-generation firewall (NGFW) and a traditional stateful firewall both inspect a connection to port 443. An attacker tunnels a command-and-control protocol over HTTPS on port 443. Which capability determines whether the C2 traffic is detected?

46 In a TLS 1.3 handshake, the use of ephemeral Diffie-Hellman (DHE/ECDHE) provides a security property that RSA key exchange (used in prior versions) did not. If an attacker records all encrypted traffic and later compromises the server's long-term private key, what is the outcome under TLS 1.3?

47 A password system stores credentials as using a fast cryptographic hash. A security audit recommends migrating to a memory-hard function. Which attack scenario BEST justifies this recommendation?

48 A microservices application uses OAuth 2.0 with JWT access tokens. A developer sets token lifetime to 24 hours to reduce authorization-server load but provides no revocation mechanism. A token is leaked. What is the fundamental security trade-off being made?

49 An enterprise deploys Single Sign-On (SSO). A risk analyst warns that SSO introduces a specific amplified risk compared to independent per-application credentials. Which statement MOST accurately captures this risk?

50 A Zero Trust architecture replaces a traditional perimeter model. An engineer argues that placing a VPN concentrator at the edge and granting authenticated users full internal network access satisfies Zero Trust. Why is this reasoning flawed?

51 A security team compares an IDS and an IPS deployed inline. During a high-throughput period, a false positive occurs on legitimate database replication traffic. Which deployment consequence distinguishes the IPS from the IDS in this scenario?

52 An organization uses IPsec in tunnel mode with ESP but omits AH, reasoning that ESP already provides confidentiality and integrity. A reviewer notes a subtle gap compared to AH. Which packet component is NOT integrity-protected by ESP alone?

53 A biometric authentication system is configured by lowering its matching threshold to reduce user frustration from rejected legitimate attempts. What is the direct security consequence of this configuration change?

54 A Role-Based Access Control (RBAC) system experiences "role explosion" as unique permission combinations proliferate. An architect proposes hierarchical roles with inheritance. Which risk does hierarchical RBAC introduce if designed carelessly?

55 During an identity lifecycle review, auditors find that terminated employees retained access for weeks. The IAM team used manual deprovisioning. Which automated control MOST directly addresses this gap at scale?

56 A microsegmentation strategy is applied in a data center using host-based firewalls on each workload. An analyst claims this makes the perimeter firewall redundant. Which argument correctly refutes this claim?

57 A web application firewall (WAF) is deployed in front of an API. It successfully blocks SQL injection signatures but a penetration tester bypasses it using JSON-encoded payloads the WAF does not parse. What does this reveal about signature-based WAF protection?

58 Two parties use Diffie-Hellman key exchange over an insecure channel without authentication. An attacker performs a man-in-the-middle attack. Why does unauthenticated DH fail here, and what addresses it?

59 An application implements MFA using SMS one-time codes. A threat model flags this factor as weaker than a hardware security key. Which attack is SMS-OTP specifically vulnerable to that a FIDO2 hardware key resists?

60 A system enforces separation of duties by preventing any single user from both creating and approving a payment. A user holds two roles whose combined permissions enable both actions. Which control concept detects this specific violation?