Practice Identity & Access Management questions for the CompTIA Security+. Every question includes a full explanation of why the correct answer is right and why the tempting distractors are wrong.
23 questions available · medium difficulty · Security+ · Free, no registration required
10 example questions with full explanations. Use the interactive practice above to work through the complete set.
Question 1easy
Multi-factor authentication (MFA) requires a user to present at least two authentication factors from different categories, such as something you know and something you have.
Correct answer: A
MFA requires two or more factors drawn from different categories: knowledge (e.g., password or PIN), possession (e.g., token or smart card), and inherence (e.g., biometrics). Using two factors from the same category — such as a password and a PIN — does not constitute true MFA because both are 'something you know.' The strength of MFA comes from combining distinct factor types, making it significantly harder for an attacker to compromise all required factors simultaneously.
Question 2easy
In a Role-Based Access Control (RBAC) model, a user's access permissions are determined by the role assigned to them rather than by individual user settings.
Correct answer: A
RBAC grants access based on a user's assigned role within an organization (e.g., 'Manager,' 'Developer,' or 'HR Analyst'). Permissions are attached to the role, and users inherit those permissions by being assigned to the role. This simplifies administration because changing a role's permissions automatically affects all users in that role, rather than requiring individual per-user adjustments. This is distinct from DAC, where the resource owner sets permissions, or ABAC, where multiple attributes are evaluated.
Question 3easy
RADIUS uses TCP as its transport protocol and separates the authentication, authorization, and accounting functions into independent processes.
Correct answer: B
This statement describes TACACS+, not RADIUS. RADIUS uses UDP as its transport protocol and combines authentication and authorization into a single process, while accounting is handled separately. TACACS+ (a Cisco-developed protocol) uses TCP for reliable transport and fully separates authentication, authorization, and accounting into three distinct processes, offering more granular control. Confusing the transport protocols and functional separation of RADIUS and TACACS+ is a common exam mistake.
Question 4easy
The Crossover Error Rate (CER), also called the Equal Error Rate (EER), is the point at which a biometric system's False Acceptance Rate equals its False Rejection Rate.
Correct answer: A
The CER (or EER) is a standard metric used to evaluate biometric system accuracy. The False Acceptance Rate (FAR) measures how often unauthorized users are incorrectly granted access, while the False Rejection Rate (FRR) measures how often legitimate users are incorrectly denied access. As sensitivity is adjusted, FAR and FRR move in opposite directions; the CER is the crossover point where they are equal. A lower CER indicates a more accurate biometric system overall.
Question 5easy
When an employee leaves an organization, their user account should be immediately deprovisioned or disabled to prevent unauthorized access to company resources.
Correct answer: A
Prompt deprovisioning is a critical step in the account lifecycle and a fundamental identity security control. Leaving an account active after an employee's departure creates an orphaned or zombie account that could be exploited by the former employee or by an attacker who discovers the credentials. Best practice is to disable or remove the account immediately upon departure, which also includes revoking associated certificates, tokens, and access privileges. Failure to deprovision accounts promptly is a common finding in security audits.
Question 6medium
A security engineer is evaluating SSO federation options for a company that needs to integrate cloud SaaS applications with its on-premises identity provider. Select all that apply: Which of the following protocols are commonly used to support SSO in enterprise and cloud environments?
- A.SAML 2.0, which uses XML-based assertions to pass authentication and authorization data between an identity provider and service provider✓
- B.OAuth 2.0, which provides a delegated authorization framework allowing third-party applications to access resources on behalf of a user
- C.LDAP, which stores and retrieves directory objects and is primarily used as the underlying authentication store rather than a federation protocol
- D.OpenID Connect (OIDC), which adds an identity layer on top of OAuth 2.0 to provide authentication and user identity claims via ID tokens✓
Correct answer: A, D
SAML 2.0 and OIDC are the two protocols specifically designed to support SSO federation. SAML 2.0 uses XML assertions to convey authentication and authorization decisions between an IdP and SP, making it standard for enterprise SSO. OIDC adds an authentication layer on top of OAuth 2.0 using ID tokens (JWTs), enabling SSO for modern web and mobile apps. OAuth 2.0 (B) is an authorization framework, not an authentication/SSO protocol by itself — it delegates resource access but does not authenticate users or establish identity, so it alone does not provide SSO. LDAP (C) is a directory access protocol used to look up credentials, not a federation or SSO protocol.
Question 7medium
An organization is implementing Privileged Access Management (PAM) to reduce risk from administrator accounts. Select all that apply: Which of the following capabilities should the security team prioritize when deploying a PAM solution?
- A.Just-in-time (JIT) access provisioning, which grants elevated privileges only for the duration needed to complete a specific task✓
- B.Privileged account vaulting, which stores and rotates credentials for privileged accounts so that administrators never know the standing password✓
- C.Replacing all privileged accounts with standard user accounts to eliminate the need for elevated access entirely
- D.Session recording and monitoring of privileged sessions to provide an audit trail of all actions taken during elevated access✓
- E.Assigning a single shared administrator account to all IT staff so that privileged credentials are easier to manage centrally
Correct answer: A, B, D
Just-in-time access (A) is a core PAM feature that minimizes the window of exposure by granting privileges only when needed and revoking them immediately after. Privileged account vaulting (B) eliminates standing credentials by automatically rotating passwords and checking them out only for approved sessions. Session recording (D) provides accountability and forensic evidence for all privileged activity. Eliminating all privileged accounts (C) is not realistic — administrative tasks require elevated access, and PAM manages rather than eliminates that need. Shared administrator accounts (E) are a security anti-pattern that destroys accountability and is exactly what PAM solutions are designed to prevent.
Question 8medium
A systems administrator is auditing user accounts across the organization and discovers several concerning account types. Select all that apply: Which of the following account conditions represent security risks that should be remediated?
- A.A network device still configured with the vendor's factory-default username and password✓
- B.A service account running a critical application that has been granted local administrator rights on all servers✓
- C.A standard user account configured with a unique username and a 14-character complex password
- D.A shared generic account used by an entire help desk team to log into the ticketing system✓
- E.An employee account that was disabled but not deleted when the employee left the company six months ago
Correct answer: A, B, D
Default credentials (A) are well-known and actively exploited; they must be changed immediately upon deployment. A service account with unnecessary local administrator rights on all servers (B) violates least privilege — if compromised, it provides broad lateral movement capability. A shared generic account (D) eliminates individual accountability, making it impossible to attribute actions in logs and creating credential-sharing risks. A standard user account with a strong unique password (C) is the expected secure configuration and is not a risk. A disabled account (E) is a concern for cleanup and storage hygiene, but because it is disabled it cannot be used to log in, making it a lower-priority issue compared to the active risks in A, B, and D.
Question 9medium
An organization is deploying smart card authentication for all employees who access sensitive government systems. Select all that apply: Which of the following statements accurately describe certificate-based authentication using smart cards?
- A.A PIV (Personal Identity Verification) card stores an X.509 digital certificate and the corresponding private key, which never leaves the card during authentication✓
- B.Smart card authentication relies on the user possessing the card and knowing the PIN, providing two-factor authentication from possession and knowledge categories✓
- C.The private key stored on a smart card is transmitted to the authentication server during the login process so the server can verify the user's identity
- D.CAC (Common Access Card) cards used by the U.S. Department of Defense contain PKI certificates that can be used for logical access, email signing, and encryption✓
Correct answer: A, B, D
PIV cards (A) embed an X.509 certificate and private key in tamper-resistant hardware; cryptographic operations are performed on-card so the private key is never exported or transmitted. Smart card + PIN (B) constitutes genuine two-factor authentication because the card represents something you have (possession) and the PIN represents something you know (knowledge). CAC cards (D) are the DoD implementation of PIV, supporting multiple PKI certificates for logical access, digital signatures, and S/MIME email encryption. Option C is false and describes a critical security flaw — the private key never leaves the smart card; instead, the card performs the signing operation locally and only the signed challenge or the public certificate is sent to the server for verification.
Question 10hard
A security engineer states: 'A user who provides a hardware OTP token code and a fingerprint scan has satisfied MFA requirements using two different authentication factors.' The engineer then adds: 'Furthermore, LDAP uses TCP port 389 for standard queries and UDP port 636 for LDAP over TLS (LDAPS), so firewall rules must account for both protocols.' Evaluate only the second claim about LDAP and LDAPS port protocols — is it true that LDAPS uses UDP port 636?
Correct answer: B
The second claim is false. LDAPS (LDAP over TLS/SSL) uses TCP port 636, not UDP port 636. LDAP is a connection-oriented protocol that relies on TCP for both its standard port (389) and its secure variant (636). UDP is not used by LDAP or LDAPS. This is a common misconception that conflates the correct port number with an incorrect transport protocol. Firewall rules for LDAPS should permit TCP 636, not UDP 636.