Question 340
After a prior credential vault finding, an international retailer reports that the approved safeguard is implemented: “Use a governed privileged-credential vault with checkout, rotation and access logs.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Verify access logging, credential rotation and denied unauthorized checkout
- Use the completion of this alternative as proof: Encrypt the spreadsheet but share its decryption password broadly
- Run this adjacent but different test as the sole proof: Disable an identity and verify downstream application sessions are invalidated as required
- Accept a signed change ticket saying: Use a governed privileged-credential vault with checkout, rotation and access logs
Explanation
Correct Answer
A:Lifecycle evidence establishes vault enforcement.
Incorrect Answers
B:A shared key preserves broad disclosure. Verify access logging, credential rotation and denied unauthorized checkout.
C:End-to-end revocation tests centralized control. It tests sso, while this case requires evidence about credential vault.
D:Verify access logging, credential rotation and denied unauthorized checkout. Lifecycle evidence establishes vault enforcement.
Question 341
After a prior identity proofing finding, a university consortium reports that the approved safeguard is implemented: “Apply identity proofing proportional to transaction risk before binding strong authenticators.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Apply identity proofing proportional to transaction risk before binding strong authenticators
- Review evidence checks and fraud detection from approved proofing workflow
- Run this adjacent but different test as the sole proof: Correlate named administrator authentication, privileges and command logs
- Use the completion of this alternative as proof: Require extra passwords without proving initial identity
Explanation
Correct Answer
B:Account enrollment assurance precedes later authentication.
Incorrect Answers
A:Review evidence checks and fraud detection from approved proofing workflow. Account enrollment assurance precedes later authentication.
C:Full AAA evidence proves accountability. It tests aaa, while this case requires evidence about identity proofing.
D:Strong login to an unverified identity does not prove the customer. Review evidence checks and fraud detection from approved proofing workflow.
Question 342
After a prior mfa finding, a cloud service provider reports that the approved safeguard is implemented: “Prioritize phishing-resistant FIDO2/WebAuthn authentication for privileged access.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run an approved origin-mismatch phishing simulation and verify failure
- Accept a signed change ticket saying: Prioritize phishing-resistant FIDO2/WebAuthn authentication for privileged access
- Use the completion of this alternative as proof: Lengthen SMS codes without changing their phishable nature
- Run this adjacent but different test as the sole proof: Test login from a look-alike domain and verify the credential cannot authenticate
Explanation
Correct Answer
A:Origin binding distinguishes resistant MFA.
Incorrect Answers
B:Run an approved origin-mismatch phishing simulation and verify failure. Origin binding distinguishes resistant MFA.
C:Longer codes can still be relayed. Run an approved origin-mismatch phishing simulation and verify failure.
D:Relying-party binding is the key security property. It tests passwordless, while this case requires evidence about mfa.
Question 343
An incident review documented this passwordless exposure: A workforce wants passwordless authentication that resists shared secrets being harvested on fake websites. The response team proposed only “Store one company-wide password in the browser” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Longer validity increases exposure.
- Strong login to an unverified identity does not prove the customer.
- Shared credentials remain phishable.
- A URL token may be copied.
Explanation
Correct Answer
C:Shared credentials remain phishable. The relevant alternative is shared credentials remain phishable.
Incorrect Answers
A:This describes the unrelated session management decision rather than the named faulty measure Store one company-wide password in the browser.
B:Strong login to an unverified identity does not prove the customer. The missing change involves shared credentials remain phishable.
D:A URL token may be copied. The actual criticized measure is shared credentials remain phishable.
Question 344
An incident review documented this sso exposure: A user logs into several business applications with separate passwords and cannot be centrally revoked. The response team proposed only “Give every application an identical local password” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Shared secrets do not create centralized revocation.
- SSO does not grant unlimited app privileges.
- Detective review does not remove standing access.
- Longer validity increases exposure.
Explanation
Correct Answer
A:Shared secrets do not create centralized revocation. The missing change involves shared secrets do not create centralized revocation.
Incorrect Answers
B:SSO does not grant unlimited app privileges. The actual criticized measure is shared secrets do not create centralized revocation.
C:Detective review does not remove standing access. That does not establish shared secrets do not create centralized revocation.
D:This describes the unrelated session management decision rather than the named faulty measure Give every application an identical local password.
Question 345
An incident review documented this aaa exposure: Network administrators authenticate correctly but their configuration changes cannot be attributed to commands. The response team proposed only “Enable only a shared password for all network devices” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Shared identity undermines accounting.
- SSO does not grant unlimited app privileges.
- UI changes cannot revoke server sessions.
- Traffic metrics do not attribute configuration actions.
Explanation
Correct Answer
A:Shared identity undermines accounting. The relevant alternative is shared identity undermines accounting.
Incorrect Answers
B:SSO does not grant unlimited app privileges. The actual criticized measure is shared identity undermines accounting.
C:UI changes cannot revoke server sessions. That does not establish shared identity undermines accounting.
D:Traffic metrics do not attribute configuration actions. The actual criticized measure is shared identity undermines accounting.
Question 346
A SaaS app trusts SAML assertions but does not validate the signing certificate or audience. Which response best addresses the central security requirement with a defensible, risk-based design?
- Trust an unsigned SAML assertion on an internal link
- Validate assertion signature, issuer, audience, expiry and replay controls
- Accept any assertion that includes a known email address
- Enforce scoped relying-party trust and tenant-specific external identifiers or equivalent federation conditions
Explanation
Correct Answer
B:Federated assertions must be authenticated for the intended relying party.
Incorrect Answers
A:Network locality does not authenticate assertions.
C:Email content alone is forgeable.
D:Third-party delegation must bind caller identity to the intended customer relationship. Validate assertion signature, issuer, audience, expiry and replay controls.
Question 347
A mobile client uses an OIDC ID token as an unrestricted API authorization credential. Which response best addresses the central security requirement with a defensible, risk-based design?
- Validate assertion signature, issuer, audience, expiry and replay controls
- Accept any JWT with a parseable header
- Ignore nonce and state in authorization flows
- Validate token audience, issuer, expiry and use an appropriate access token for API authorization
Explanation
Correct Answer
D:Identity tokens describe authentication; resource APIs should enforce intended audience and scopes.
Incorrect Answers
A:Federated assertions must be authenticated for the intended relying party. Validate token audience, issuer, expiry and use an appropriate access token for API authorization.
B:Parsing does not prove signature or audience.
C:Missing protocol checks can permit replay/CSRF.
Question 348
A managed support provider can assume the same customer role across many tenants without a customer-specific context. Which response best addresses the central security requirement with a defensible, risk-based design?
- Enforce scoped relying-party trust and tenant-specific external identifiers or equivalent federation conditions
- Treat a secret role name as authorization
- Give the supplier account-root keys
- Validate token audience, issuer, expiry and use an appropriate access token for API authorization
Explanation
Correct Answer
A:Third-party delegation must bind caller identity to the intended customer relationship.
Incorrect Answers
B:Role identifiers are discoverable and not authenticators.
C:Root credentials remove scope and revocation.
D:Identity tokens describe authentication; resource APIs should enforce intended audience and scopes. Enforce scoped relying-party trust and tenant-specific external identifiers or equivalent federation conditions.
Question 349
On-premises staff need cloud roles while HR offboarding remains authoritative. Which response best addresses the central security requirement with a defensible, risk-based design?
- Trust any identity provider without mapping audiences and claims
- Create permanent cloud users independent of HR
- Federate workforce identities with central account assignments and synchronized group lifecycle
- Validate assertion signature, issuer, audience, expiry and replay controls
Explanation
Correct Answer
C:Hybrid identity must support timely joiner-mover-leaver updates.
Incorrect Answers
A:Weak federation trust can grant unintended access.
B:Duplicate accounts linger after termination.
D:Federated assertions must be authenticated for the intended relying party. Federate workforce identities with central account assignments and synchronized group lifecycle.
Question 350
After a prior saml finding, a cloud service provider reports that the approved safeguard is implemented: “Validate assertion signature, issuer, audience, expiry and replay controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Offboard a test identity and verify cloud role grants disappear
- Accept a signed change ticket saying: Validate assertion signature, issuer, audience, expiry and replay controls
- Attempt expired and wrong-audience assertions and verify rejection
- Use the completion of this alternative as proof: Accept any assertion that includes a known email address
Explanation
Correct Answer
C:Negative tests validate federation trust.
Incorrect Answers
A:Lifecycle propagation is key. It tests cloud/hybrid federation, while this case requires evidence about saml.
B:Attempt expired and wrong-audience assertions and verify rejection. Negative tests validate federation trust.
D:Email content alone is forgeable. Attempt expired and wrong-audience assertions and verify rejection.
Certified Information Systems Security Professional (CISSP) Practice Tests