Question 350
After a prior saml finding, a cloud service provider reports that the approved safeguard is implemented: “Validate assertion signature, issuer, audience, expiry and replay controls.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Offboard a test identity and verify cloud role grants disappear
- Accept a signed change ticket saying: Validate assertion signature, issuer, audience, expiry and replay controls
- Attempt expired and wrong-audience assertions and verify rejection
- Use the completion of this alternative as proof: Accept any assertion that includes a known email address
Explanation
Correct Answer
C:Negative tests validate federation trust.
Incorrect Answers
A:Lifecycle propagation is key. It tests cloud/hybrid federation, while this case requires evidence about saml.
B:Attempt expired and wrong-audience assertions and verify rejection. Negative tests validate federation trust.
D:Email content alone is forgeable. Attempt expired and wrong-audience assertions and verify rejection.
Question 351
An application receives ID tokens from two identity providers but fails to check the intended issuer and audience. Which response best addresses the central security requirement with a defensible, risk-based design?
- Validate assertion signature, issuer, audience, expiry and replay controls
- Trust an email string inside an unverified JSON object
- Validate issuer, audience, signature and time claims before establishing an authenticated session
- Accept any cryptographically valid token from any configured provider
Explanation
Correct Answer
C:A signed token is not necessarily intended for this relying party.
Incorrect Answers
A:Federated assertions must be authenticated for the intended relying party. Validate issuer, audience, signature and time claims before establishing an authenticated session.
B:Unverified claims cannot authenticate identity.
D:Cross-application tokens can be misused.
Question 352
After a prior third-party trust finding, a global logistics firm reports that the approved safeguard is implemented: “Enforce scoped relying-party trust and tenant-specific external identifiers or equivalent federation conditions.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Enforce scoped relying-party trust and tenant-specific external identifiers or equivalent federation conditions
- Run this adjacent but different test as the sole proof: Offboard a test identity and verify cloud role grants disappear
- Use the completion of this alternative as proof: Treat a secret role name as authorization
- Simulate cross-tenant role confusion and verify the wrong tenant is denied
Explanation
Correct Answer
D:Confused-deputy testing validates tenant boundaries.
Incorrect Answers
A:Simulate cross-tenant role confusion and verify the wrong tenant is denied. Confused-deputy testing validates tenant boundaries.
B:Lifecycle propagation is key. It tests cloud/hybrid federation, while this case requires evidence about third-party trust.
C:Role identifiers are discoverable and not authenticators. Simulate cross-tenant role confusion and verify the wrong tenant is denied.
Question 353
After a prior cloud/hybrid federation finding, a regional hospital network reports that the approved safeguard is implemented: “Federate workforce identities with central account assignments and synchronized group lifecycle.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Offboard a test identity and verify cloud role grants disappear
- Run this adjacent but different test as the sole proof: Simulate cross-tenant role confusion and verify the wrong tenant is denied
- Use the completion of this alternative as proof: Create permanent cloud users independent of HR
- Accept a signed change ticket saying: Federate workforce identities with central account assignments and synchronized group lifecycle
Explanation
Correct Answer
A:Lifecycle propagation is key.
Incorrect Answers
B:Confused-deputy testing validates tenant boundaries. It tests third-party trust, while this case requires evidence about cloud/hybrid federation.
C:Duplicate accounts linger after termination. Offboard a test identity and verify cloud role grants disappear.
D:Offboard a test identity and verify cloud role grants disappear. Lifecycle propagation is key.
Question 354
An incident review documented this saml exposure: A SaaS app trusts SAML assertions but does not validate the signing certificate or audience. The response team proposed only “Accept any assertion that includes a known email address” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Missing protocol checks can permit replay/CSRF.
- Duplicate accounts linger after termination.
- Email content alone is forgeable.
- Network locality does not authenticate assertions.
Explanation
Correct Answer
C:Email content alone is forgeable. The relevant alternative is email content alone is forgeable.
Incorrect Answers
A:Missing protocol checks can permit replay/CSRF. The actual criticized measure is email content alone is forgeable.
B:Duplicate accounts linger after termination. The actual criticized measure is email content alone is forgeable.
D:Network locality does not authenticate assertions. The actual criticized measure is email content alone is forgeable.
Question 355
A hospital application gives every nurse database administrator privileges to view patient charts. Which response best addresses the central security requirement with a defensible, risk-based design?
- Grant all medical staff one administrator role
- Map job functions to narrowly scoped roles with permissions separated by task
- Manage permissions through unrelated personal exceptions only
- Evaluate trusted subject, resource and context attributes in authorization policy
Explanation
Correct Answer
B:RBAC models operational duties, not unrestricted user attributes.
Incorrect Answers
A:Shared broad authority defeats separation.
C:Individual exceptions become ungovernable.
D:ABAC scales fine-grained decisions when attributes are governed. Map job functions to narrowly scoped roles with permissions separated by task.
Question 356
A multi-department system needs access based on verified department and record classification. Which response best addresses the central security requirement with a defensible, risk-based design?
- Let users self-assign a privileged department attribute
- Evaluate trusted subject, resource and context attributes in authorization policy
- Use only one static admin role for all departments
- Ensure policy enforcement points cover every resource path and consult the decision authority
Explanation
Correct Answer
B:ABAC scales fine-grained decisions when attributes are governed.
Incorrect Answers
A:Untrusted principal attributes enable escalation.
C:Broad roles do not support attribute distinctions.
D:A correct PDP rule cannot protect traffic that avoids the PEP. Evaluate trusted subject, resource and context attributes in authorization policy.
Question 357
A classified system's users must not change security labels or grant access at discretion. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use mandatory central labels and enforcement controlled by trusted policy authority
- Use discretionary access controls where owners can grant permitted rights under organizational constraints
- Grant clearance solely on project manager preference
- Allow each file owner to remove classification labels
Explanation
Correct Answer
A:Mandatory access control does not delegate security label decisions to object owners.
Incorrect Answers
B:DAC delegates some sharing choices to resource owners. Use mandatory central labels and enforcement controlled by trusted policy authority.
C:Formal clearance and need to know are still required.
D:Discretionary overrides undermine mandatory policy.
Question 358
A research collaboration allows document owners to share selected files with colleagues. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use discretionary access controls where owners can grant permitted rights under organizational constraints
- Publish every file without a grant boundary
- Ensure policy enforcement points cover every resource path and consult the decision authority
- Treat all files as centrally immutable mandatory labels
Explanation
Correct Answer
A:DAC delegates some sharing choices to resource owners.
Incorrect Answers
B:Discretion does not imply unrestricted public access.
C:A correct PDP rule cannot protect traffic that avoids the PEP. Use discretionary access controls where owners can grant permitted rights under organizational constraints.
D:Mandatory policy is different from owner discretion.
Question 359
A customer login originates from an impossible-travel session on an unmanaged device. Which response best addresses the central security requirement with a defensible, risk-based design?
- Block every user permanently after one anomaly
- Always permit a correct password regardless of risk
- Use discretionary access controls where owners can grant permitted rights under organizational constraints
- Step up authentication or restrict the session based on evaluated risk signals
Explanation
Correct Answer
D:Adaptive access changes controls with observed context.
Incorrect Answers
A:Unbounded denial harms availability.
B:Credentials alone may be compromised.
C:DAC delegates some sharing choices to resource owners. Step up authentication or restrict the session based on evaluated risk signals.
Question 360
A zero-trust gateway has a correct access policy but an application endpoint bypasses the gateway. Which response best addresses the central security requirement with a defensible, risk-based design?
- Update only the policy text without fixing bypass route
- Assume network ACLs evaluate user-level claims
- Ensure policy enforcement points cover every resource path and consult the decision authority
- Evaluate trusted subject, resource and context attributes in authorization policy
Explanation
Correct Answer
C:A correct PDP rule cannot protect traffic that avoids the PEP.
Incorrect Answers
A:Unmediated calls still succeed.
B:Layer-three rules cannot implement the entire policy.
D:ABAC scales fine-grained decisions when attributes are governed. Ensure policy enforcement points cover every resource path and consult the decision authority.
Certified Information Systems Security Professional (CISSP) Practice Tests