Controlling who (and what) can access which resources: identification, authentication factors, access control models, federation and the identity lifecycle.
Type 1 = something you know (PIN) · Type 2 = have (smart card, token, passkey device) · Type 3 = are (biometric) · MFA = different TYPES · Best low-friction secure = native biometrics / passkeys (FIDO2) · SMS OTP and security questions are weak.
Biometrics
Type I error = false rejection (FRR, annoying) · Type II = false acceptance (FAR, dangerous) · lower CER/EER = more accurate. Lowering sensitivity → FRR down, FAR up.
Access control models
DAC = owner decides · MAC = labels and clearances · RBAC = job role · ABAC = attributes (department + time + device + location) · Rule-based = global rules · Content-dependent = what is inside · Context-dependent = circumstances (time, session, location).
SSO / federation
SAML: IdP authenticates, SP consumes the assertion · OAuth 2.0 = authorization (delegated access) · OIDC = authentication on top of OAuth (ID token) · Federation = trust across organisations.
Kerberos
KDC = AS (issues TGT) + TGS (service tickets) · symmetric crypto · needs time sync · KDC = single point of failure · Golden ticket = KRBTGT hash (whole domain) · Silver ticket = one service account.
Try each question before opening the answer. The full bank has many more Domain 5 questions with filters and progress tracking.
Question 1 · FIRST
An employee transfers from Finance to Marketing. What should happen FIRST to their access?
Disable the account until the new manager requests access
Keep both sets of access so the employee can support the handover
Add Marketing access and review Finance access at the next annual review
Remove Finance access and provision Marketing access based on the new role
Show answer & explanation
Answer: D — Remove Finance access and provision Marketing access based on the new role
Role changes (movers) must trigger removal of old access and provisioning of new role-based access to prevent privilege creep. Waiting for annual reviews or keeping both violates least privilege; disabling the account stops legitimate work.
Question 2 · NEXT
A user has entered a correct username and password. The organisation's policy requires MFA. What happens NEXT in the access sequence?
The user's account is provisioned in the directory
The system grants the permissions assigned to the user's role
The user proves a second factor before authentication completes
The system writes the user's actions to the audit log
Show answer & explanation
Answer: C — The user proves a second factor before authentication completes
Identification and the first factor are done; with MFA required, authentication is not complete until the second factor is verified. Authorization and accountability follow; provisioning happened long before.
Question 3 · LEAST
Which access control model gives the LEAST central control over who can access a file?
Attribute-based access control (ABAC)
Role-based access control (RBAC)
Discretionary access control (DAC)
Mandatory access control (MAC)
Show answer & explanation
Answer: C — Discretionary access control (DAC)
In DAC the owner of the object decides who can access it, so control is distributed among users. MAC, RBAC and ABAC are enforced centrally through labels, roles or policies.
Question 4 · NOT
What is a major architectural weakness of standard Kerberos implementations if NOT properly clustered/redundant?
It cannot be used for internal enterprise networks.
It relies on asymmetric encryption which is too slow.
It sends passwords in cleartext.
The Key Distribution Center (KDC) is a single point of failure.
Show answer & explanation
Answer: D — The Key Distribution Center (KDC) is a single point of failure.
Question 5 · BEST
An audit finds that many employees still have access rights from previous roles after internal transfers. Which control would BEST address this?
Dual control for sensitive transactions
Periodic access reviews and recertification
Session recording for all users
Mandatory multifactor authentication
Show answer & explanation
Answer: B — Periodic access reviews and recertification
Old rights piling up = privilege creep → PERIODIC ACCESS REVIEW/recertification removes unneeded access. MFA, dual control and session recording don't remove excess rights.
Question 6 · PRIMARY
Why must every user have a unique user ID rather than sharing accounts? The PRIMARY reason is to:
Provide accountability by tracing actions to an individual
Allow single sign-on to work across applications
Reduce the number of licences the organisation must purchase
Make password resets faster for the help desk
Show answer & explanation
Answer: A — Provide accountability by tracing actions to an individual
Accountability depends on unique identification: logs can only prove who did what if each identity maps to one person. Licensing, help desk speed and SSO are not the security reason.
Question 7 · MOST
An IAM architect is upgrading multi-factor authentication (MFA) for administrative cloud portals to mitigate sophisticated phishing attacks. Which MFA method provides the HIGHEST resistance against SIM-swapping and adversary-in-the-middle (AiTM) phishing?
Voice call verification codes transmitted over public switched telephone networks
FIDO2 / WebAuthn hardware security keys using public-key cryptography
SMS-based One-Time Passwords (OTP) sent over cellular networks
Email-based verification links sent to unencrypted personal webmail accounts
Show answer & explanation
Answer: B — FIDO2 / WebAuthn hardware security keys using public-key cryptography
Option B is correct because FIDO2/WebAuthn binds origin domain names cryptographically, rendering AiTM phishing and SIM swap attacks completely ineffective. Option C is incorrect because SMS OTPs are vulnerable to SIM swapping, SS7 interception, and AiTM proxying. Option D is wrong because email links can be intercepted or phished. Option A is incorrect because voice call OTPs suffer from telephony interception vulnerabilities.
Question 8
A single-page application performing OAuth must protect its authorization code from interception on public clients that cannot keep a client secret. Which mechanism addresses this risk?
A scheme that replaces OAuth entirely
A mechanism reserved only for backend servers
PKCE, mitigating authorization code interception for public clients
An entirely optional extension with no security value
Show answer & explanation
Answer: C — PKCE, mitigating authorization code interception for public clients
Proof Key for Code Exchange binds the authorization request to a verifier, preventing intercepted codes from being redeemed by an attacker. PKCE does not replace OAuth, is not limited to servers, and is now recommended for all clients, so the other options are incorrect.
Question 9 · FIRST
A company is deploying a new identity governance platform. What should the project team do FIRST?
Connect every application to the platform using available connectors
Define identity lifecycle processes and data ownership with HR and business owners
Run a full access review campaign across the organisation
Configure automatic deprovisioning rules for terminated employees
Show answer & explanation
Answer: B — Define identity lifecycle processes and data ownership with HR and business owners
Tools automate processes; the joiner-mover-leaver process, authoritative sources (usually HR) and ownership must be defined first. Connecting apps, running reviews or automating deprovisioning without agreed processes automates confusion.
Question 10 · NEXT
A biometric fingerprint system at a data centre is rejecting many legitimate employees, causing complaints. Management asks you to adjust it. What happens NEXT if you lower the sensitivity?
The crossover error rate of the device improves permanently
The false acceptance rate falls but the false rejection rate rises
Both the false rejection and false acceptance rates fall
The false rejection rate falls but the false acceptance rate rises
Show answer & explanation
Answer: D — The false rejection rate falls but the false acceptance rate rises
FRR (Type I) and FAR (Type II) trade off against each other. Lowering sensitivity accepts more people, reducing false rejections but increasing false acceptances. The CER is a property of the device and does not improve by tuning.
Ready for the full bank?
2,000+ explained questions, timed mocks and a CAT simulator that behaves like the real exam.
