Domain 3: Identity and Access Management (IAM) Concepts

Question 1

Which access configuration model fundamentally violates the core information security principle of Segregation of Duties?

Implementing role-based access frameworks that restrict system privileges based strictly on designated organizational responsibilities. Utilizing mandatory access controls to separate sensitive data segments and enforce strict departmental compartmentalization. Assigning dual control mandates where multiple authorized personnel collaborate to execute a single sensitive procedure. An administrative entity possessing comprehensive permissions authorizing the execution of an entire critical transaction life cycle.

Correct Answer: An administrative entity possessing comprehensive permissions authorizing the execution of an entire critical transaction life cycle.

Allowing a single administrative entity to execute an entire critical transaction life cycle fundamentally violates Segregation of Duties because it removes required oversight and enables one person to commit and conceal fraud.
Role based access frameworks actually support this principle by strictly limiting privileges to designated job functions. Utilizing mandatory access controls enforces necessary compartmentalization rather than violating it. Assigning dual control mandates directly implements oversight by requiring collaboration for sensitive procedures, the exact opposite of a violation.
The key concept tested is the principle of Segregation of Duties to mitigate fraud and error risks.

Question 2

A security team is tasked with setting up a new document management system for a government agency. The agency mandates a strict framework based on system-assigned labels rather than data owner preferences. To properly align with this mandatory framework, what is the best way for the team to establish the foundational access structure?

Define classification tiers for all stored objects and centrally map matching clearance levels to user accounts. Organize user groups into specific occupational roles and assign broad system privileges to those containers. Enable department supervisors to configure specific access controls based upon specialized departmental requirements. Process authorization requests by analyzing environmental conditions, physical location, and time parameters.

Correct Answer: Define classification tiers for all stored objects and centrally map matching clearance levels to user accounts.

Defining classification tiers for all stored objects and centrally mapping them to matching user clearance levels correctly implements Mandatory Access Control, which explicitly relies on rigid, centrally enforced security labels instead of end user or data owner discretion.
Allowing department supervisors to configure specific access controls reflects Discretionary Access Control where owners determine permissions. Organizing user groups into specific occupational roles describes Role Based Access Control. Processing authorization requests by analyzing environmental conditions or physical location points to Attribute Based Access Control.
The key concept tested is understanding and differentiating between logical access control models, specifically the implementation of Mandatory Access Control within secure environments.

Question 3

Which foundational access control principle mandates that permissions granted to subjects should be restricted to the minimum set required to complete their assigned tasks?

Principle of Least Privilege Principle of Separation of Duties Principle of Need-to-Know Access Principle of Minimal Accountability and Access Control

Correct Answer: Principle of Least Privilege

The Principle of Least Privilege is the foundational access control concept that mandates subjects should only be granted the minimum permissions necessary to perform their assigned tasks, nothing more.

Need-to-Know Access is a related but narrower concept focused specifically on restricting access to information rather than all permissions broadly. Minimal Accountability and Access Control is a fabricated term not recognized as a standard security principle. Separation of Duties addresses dividing critical tasks among multiple individuals to prevent fraud or error, not minimizing permissions.

The key concept tested is understanding the Principle of Least Privilege as a core access control mechanism in cybersecurity.

Domain 3: Identity and Access Management (IAM) Concepts

CC - Domain 3: Identity and Access Management (IAM) Concepts Example Questions

Question 1

Question 2

Question 3

Begin Your Cybersecurity Career