Identity Management Practice Questions

Answers and explanations appear when you work through the set above.

1. Which option is a valid example of two-factor authentication?

   • A password followed by several personal security questions
   • A password combined with a hardware security key
   • A fingerprint followed by facial recognition
   • A PIN entered twice on separate screens

2. A biometric system is rejecting too many legitimate users at a factory entrance. Which metric should the security manager examine FIRST to quantify this problem?

   • False acceptance rate
   • Crossover error rate
   • False rejection rate
   • Enrollment throughput

3. During biometric product selection, a vendor reports a crossover error rate of 0.8 percent. What does this figure MOST directly represent?

   • The percentage of enrolled users who cannot complete registration
   • The number of users processed per minute during enrollment
   • The percentage of impostor attempts accepted at the default threshold
   • The error rate where false acceptance and false rejection are equal

4. A security manager is reviewing a proposed fingerprint login that stores templates in a central service. Which requirement is MOST important to add to the design?

   • Pair the biometric with a physical authenticator and protect the sensor-to-verifier channel
   • Allow the fingerprint to serve as the only authentication factor because it is unique
   • Store raw fingerprint images in the central service for reissuance when a user forgets the template
   • Increase the matching threshold until false rejections are eliminated

5. Which password policy change is the BEST priority for reducing successful online password guessing?

   • Require every password to contain one punctuation mark and one uppercase letter
   • Force users to change passwords every 30 days regardless of risk
   • Block commonly used or compromised passwords and rate-limit failed attempts
   • Permit short passwords when users have completed security awareness training

6. An employee transfers from finance to engineering. What should the IAM team do FIRST under a well-controlled provisioning lifecycle?

   • Keep all existing privileges and add the engineering role to avoid disruption
   • Approve the change and remove finance entitlements
   • Delete the identity and create a new account with the same password
   • Wait for the next quarterly access review before changing access

7. A contractor's engagement ends today. Which action BEST reduces the risk of continued access?

   • Disable the contractor's email account and preserve application credentials for evidence until the next scheduled access review
   • Ask the contractor to change each password before leaving
   • Remove the contractor from the identity directory but leave active sessions untouched
   • Use approved offboarding to disable identity, revoke credentials, end sessions, and remove entitlements

8. A company is replacing manually issued administrator certificates with a credential management system. Which capability should the security architect consider MOST essential?

   • A shared administrator account with a centralized certificate issuance and renewal service
   • Credential inventory, controlled issuance, expiry, renewal, revocation, and audit
   • Permanent certificates issued to administrators to prevent interruptions during renewal
   • Email private keys to administrators and retain the messages as the credential inventory and recovery record

9. An application receives a validated identity assertion from a trusted identity provider. What must the application still determine before allowing a user to export payroll data?

   • Whether the subject may perform the requested export on payroll data
   • Whether the subject has been identified by a unique username
   • Whether the identity provider used a password rather than a token
   • Whether the subject's biometric enrollment throughput is acceptable