, Question 1
A security architect is designing a zero trust architecture for a hybrid cloud
environment. The requirement is to enforce least privilege for
machine-to-machine API calls without relying on static secrets. Which of the
following mechanisms best satisfies this requirement?
A. OAuth 2.0 client credentials flow with long-lived client secrets stored
in a hardware security module (HSM).
B. Mutual TLS (mTLS) with short-lived X.509 certificates issued by an
internal certificate authority and automatically rotated via SPIFFE/SPIRE.
C. SAML 2.0 assertions signed by an identity provider, with session
cookies valid for 8 hours.
D. API keys stored in a secrets manager and injected as environment
variables at runtime.
Correct Answer: B - Mutual TLS (mTLS) with short-lived X.509
certificates issued by an internal certificate authority and
automatically rotated via SPIFFE/SPIRE.
RATIONALE
mTLS with SPIFFE/SPIRE provides cryptographic identity with
automatic rotation, eliminating static secrets and supporting zero trust.
OAuth client secrets, even in HSMs, are still static and long-lived.
SAML is for user authentication, not machine-to-machine. API keys
are static and vulnerable to leakage.
Question 2
An identity governance team is implementing role-based access control
(RBAC) but faces frequent role explosion and entitlement creep. Which
approach best addresses these issues while maintaining least privilege?
A. Adopting attribute-based access control (ABAC) with dynamic
policies evaluated at runtime.
B. Increasing the number of roles to cover every possible job function.
Page 2
, C. Implementing static separation of duties (SoD) with annual manual
reviews.
D. Using discretionary access control (DAC) where resource owners
assign permissions.
Correct Answer: A - Adopting attribute-based access control
(ABAC) with dynamic policies evaluated at runtime.
RATIONALE
ABAC uses attributes and policies to grant fine-grained access
dynamically, reducing role explosion and entitlement creep. More
roles exacerbate the problem. Static SoD and annual reviews are
insufficient for dynamic environments. DAC lacks centralized control
and least privilege enforcement.
Question 3
During a red team exercise, an attacker with valid low-privilege credentials
moved laterally to a domain controller by exploiting a Kerberos delegation
misconfiguration. Which mitigation most effectively prevents this attack?
A. Enforcing unconstrained Kerberos delegation for all service accounts.
B. Implementing resource-based constrained delegation (RBCD) with
strict access controls.
C. Disabling Kerberos armoring (FAST) to improve performance.
D. Using NTLM instead of Kerberos for authentication.
Correct Answer: B - Implementing resource-based constrained
delegation (RBCD) with strict access controls.
RATIONALE
RBCD restricts delegation to specific resources and requires explicit
permissions, mitigating lateral movement via delegation abuse.
Unconstrained delegation is highly vulnerable. Disabling FAST
weakens security. NTLM is less secure and not a mitigation.
Page 3
, Question 4
A financial institution must comply with PSD2's Strong Customer
Authentication (SCA) for online payments. Which combination of factors
satisfies SCA requirements?
A. Password and security question.
B. Fingerprint and one-time password (OTP) sent via SMS.
C. Knowledge-based authentication (KBA) and email link.
D. PIN and a static code printed on the card.
Correct Answer: B - Fingerprint and one-time password (OTP)
sent via SMS.
RATIONALE
SCA requires two independent factors from different categories:
inherence (fingerprint) and possession (OTP via SMS). Password and
security question are both knowledge factors. KBA and email link are
both knowledge/possession but email is not considered strong
possession. PIN and static code are both knowledge/possession but
static code is not dynamic.
Question 5
An organization is adopting FIDO2/WebAuthn for passwordless
authentication. Which statement about the role of the relying party (RP) is
correct?
A. The RP generates and stores the private key on behalf of the user.
B. The RP validates the signature using the public key associated with the
user's authenticator.
C. The RP must store biometric data to verify the user's identity.
D. The RP relies on a shared secret between the authenticator and the
server.
Correct Answer: B - The RP validates the signature using the
public key associated with the user's authenticator.
Page 4
A security architect is designing a zero trust architecture for a hybrid cloud
environment. The requirement is to enforce least privilege for
machine-to-machine API calls without relying on static secrets. Which of the
following mechanisms best satisfies this requirement?
A. OAuth 2.0 client credentials flow with long-lived client secrets stored
in a hardware security module (HSM).
B. Mutual TLS (mTLS) with short-lived X.509 certificates issued by an
internal certificate authority and automatically rotated via SPIFFE/SPIRE.
C. SAML 2.0 assertions signed by an identity provider, with session
cookies valid for 8 hours.
D. API keys stored in a secrets manager and injected as environment
variables at runtime.
Correct Answer: B - Mutual TLS (mTLS) with short-lived X.509
certificates issued by an internal certificate authority and
automatically rotated via SPIFFE/SPIRE.
RATIONALE
mTLS with SPIFFE/SPIRE provides cryptographic identity with
automatic rotation, eliminating static secrets and supporting zero trust.
OAuth client secrets, even in HSMs, are still static and long-lived.
SAML is for user authentication, not machine-to-machine. API keys
are static and vulnerable to leakage.
Question 2
An identity governance team is implementing role-based access control
(RBAC) but faces frequent role explosion and entitlement creep. Which
approach best addresses these issues while maintaining least privilege?
A. Adopting attribute-based access control (ABAC) with dynamic
policies evaluated at runtime.
B. Increasing the number of roles to cover every possible job function.
Page 2
, C. Implementing static separation of duties (SoD) with annual manual
reviews.
D. Using discretionary access control (DAC) where resource owners
assign permissions.
Correct Answer: A - Adopting attribute-based access control
(ABAC) with dynamic policies evaluated at runtime.
RATIONALE
ABAC uses attributes and policies to grant fine-grained access
dynamically, reducing role explosion and entitlement creep. More
roles exacerbate the problem. Static SoD and annual reviews are
insufficient for dynamic environments. DAC lacks centralized control
and least privilege enforcement.
Question 3
During a red team exercise, an attacker with valid low-privilege credentials
moved laterally to a domain controller by exploiting a Kerberos delegation
misconfiguration. Which mitigation most effectively prevents this attack?
A. Enforcing unconstrained Kerberos delegation for all service accounts.
B. Implementing resource-based constrained delegation (RBCD) with
strict access controls.
C. Disabling Kerberos armoring (FAST) to improve performance.
D. Using NTLM instead of Kerberos for authentication.
Correct Answer: B - Implementing resource-based constrained
delegation (RBCD) with strict access controls.
RATIONALE
RBCD restricts delegation to specific resources and requires explicit
permissions, mitigating lateral movement via delegation abuse.
Unconstrained delegation is highly vulnerable. Disabling FAST
weakens security. NTLM is less secure and not a mitigation.
Page 3
, Question 4
A financial institution must comply with PSD2's Strong Customer
Authentication (SCA) for online payments. Which combination of factors
satisfies SCA requirements?
A. Password and security question.
B. Fingerprint and one-time password (OTP) sent via SMS.
C. Knowledge-based authentication (KBA) and email link.
D. PIN and a static code printed on the card.
Correct Answer: B - Fingerprint and one-time password (OTP)
sent via SMS.
RATIONALE
SCA requires two independent factors from different categories:
inherence (fingerprint) and possession (OTP via SMS). Password and
security question are both knowledge factors. KBA and email link are
both knowledge/possession but email is not considered strong
possession. PIN and static code are both knowledge/possession but
static code is not dynamic.
Question 5
An organization is adopting FIDO2/WebAuthn for passwordless
authentication. Which statement about the role of the relying party (RP) is
correct?
A. The RP generates and stores the private key on behalf of the user.
B. The RP validates the signature using the public key associated with the
user's authenticator.
C. The RP must store biometric data to verify the user's identity.
D. The RP relies on a shared secret between the authenticator and the
server.
Correct Answer: B - The RP validates the signature using the
public key associated with the user's authenticator.
Page 4
