Domain 5 Practice Test: Identity and Access Management

How to take this test

This test covers the whole of Domain 5, which the book teaches in two parts. Chapter 19 gave you the grammar: the identity four-step of claim, prove, permit, record; the authentication factors and the standards that grade them; the access control models that turn proof into permission; and the administration shapes that decide who runs the identity shop. Chapter 20 gave you the machinery: the joiner-mover-leaver lifecycle, the directory, the federation protocols from Kerberos to SAML to OAuth and OpenID Connect, SCIM provisioning, and the privileged access layer. The 25 questions below are drawn from both chapters, and they are built to be classified, not merely recalled.

That last sentence is the point of the domain, so hold it while you work. An IAM scenario is a story about one thing being wrong: a step that never happened, a factor that can be replayed, a model that lets the wrong person decide, a gap between a system that knows and a system that does not. Chapter 19 taught you to name the step: identification, authentication, authorization, or accountability. Chapter 20 taught you to name the gap: lifecycle, directory, trust, or privilege. When you read a stem, run that classifier before you look at the options. The correct answer is almost always the control or the standard that belongs to the exact thing that is wrong, and the three wrong options are usually the controls that would fix a different thing.

A few questions here reward standards recall, an RFC number or a control identifier, and they are deliberate, because the exam does name standards and the book names the ones that matter. But notice what those questions actually ask. They do not ask what a standard is called. They describe a property, a per-command authorization exchange, a REST provisioning channel, a token signed over its header and payload, and they ask which standard has that property. If you learn the properties, the names follow.

Set the clock for thirty minutes before you read the first stem: a minute and a quarter per item, the pace this book assumes for a full 150-item session. Answer every question, even the ones you would rather skip, because a blank is wrong and the real engine never asks why you left it empty. Do not open the answer key early, and do not return to a question once you have moved past it. The adaptive exam gives you no item review, and the practice that transfers is the practice that reproduces that constraint. When a question forces a guess, guess cleanly and keep moving; the score sheet is where the analysis happens, not the test session.

When the clock stops, score yourself honestly and read the score interpretation before you touch anything else. The number is a triage instrument, not a verdict. It tells you which part of Domain 5 deserves your next study hours, and the specific questions you missed tell you which exact ideas to rebuild.

The 25 questions

1. A bank’s web application lets employees submit payment batches. After a user signs in with a username and password, the application checks which of the user’s roles include the right to approve payments. Users holding the “payment approver” role see the approval queue; everyone else sees a read-only view of their own submissions. Which step of the access control process produces the difference between the two views?

   A. Identification B. Authentication C. Accountability D. Authorization

2. An organization requires every administrator to authenticate with a password plus a one-time code generated by a hardware token the administrator carries. Which statement correctly describes this scheme?

   A. It is single-factor, because the token is only a container for a secret B. It is two-factor, because the password is something you know and the token is something you have C. It is two-step but single-factor, because both factors authenticate the same person D. It is an example of inherence, because the code changes over time

3. Per NIST SP 800-63B, which combination of practices best defends accounts against credential stuffing, where attackers replay passwords stolen from other sites?

   A. Require 12 characters with at least one uppercase letter, one digit, and one symbol, and rotate the password every 90 days B. Store passwords in a reversibly encrypted database so the support team can recover forgotten ones C. Allow any length, but forbid reusing a password that is more than two years old D. Screen new secrets against lists of known compromised values, allow long passphrases, and rate-limit authentication attempts

4. A biometric access system lets administrators tune the acceptance threshold. The team raises the threshold so that a fingerprint must match the stored template much more closely to be accepted. Which effect follows?

   A. The false accept rate falls and the false reject rate rises B. The false accept rate rises and the false reject rate falls C. Both the false accept rate and the false reject rate fall D. Neither rate changes, because the rates are properties of the sensor

5. A hospital switches all clinical workstations to a network where the access switch refuses to forward traffic from a laptop until the laptop has completed an authentication exchange with a central server, with the exchange carried by the Extensible Authentication Protocol. Which mechanism does this describe?

   A. IEEE 802.1X port-based network access control B. Kerberos ticket renewal at the switch C. MAC flooding with port security D. Dual control at the network edge

6. A federal agency issues employees smart cards under FIPS 201. The card holds a private key that was generated on the card and cannot be extracted, and each use requires the employee to enter a PIN. Why is this arrangement considered two-factor authentication?

   A. Because the PIN is a possession factor and the card is a knowledge factor B. Because the card is a possession factor and the PIN is a knowledge factor, two different categories of evidence C. Because both the card and the PIN are inherence factors D. Because the PIN alone is sufficient to prove the user’s identity

7. In a government system handling classified documents, users cannot change the sensitivity label on a file, and the system permits access only when the user’s clearance is at least as high as the file’s label. Which access control model enforces this arrangement?

   A. Mandatory access control B. Discretionary access control C. Role-based access control D. Rule-based access control

8. On a project file share, the person who creates a folder can grant access to colleagues and can pass on the ability to grant access, so permissions spread without an administrator’s involvement. Which access control model is in use?

   A. Mandatory access control B. Attribute-based access control C. Lattice-based access control D. Discretionary access control

9. A credit union requires that no single employee can both approve a loan and disburse its funds. The access team uses role-based access control and must implement the requirement in the role structure. Per the RBAC model formalized in ANSI INCITS 359-2004, what is the correct implementation?

   A. Split the conflicting permissions into mutually exclusive roles so no person can hold both B. Create one combined role and rely on training to prevent abuse C. Assign the two permissions directly to different individuals, outside the role structure D. Grant both permissions to the role and review the audit log after each loan

10. A data platform evaluates every access request against a policy that reads: allow read when subject.department equals finance and object.classification equals internal and current time is within business hours. Which model performs this decision?

    A. Discretionary access control B. Mandatory access control C. Attribute-based access control D. Lattice-based access control

11. A hospital’s security analysts all hold the same “analyst” role, which grants read access to every patient incident record in the system, including incidents assigned to other analysts. An analyst with no involvement in a case reads its records out of curiosity. Which principle was violated?

    A. Least privilege, because the role grants more actions than the job requires B. Separation of duties, because analysts should not read what they investigate C. Need-to-know, because access should be limited to the data required for the task D. Dual control, because two analysts should be required to open a record

12. A manufacturer runs account administration separately in each business unit. A plant manager transferred from production to logistics nine months ago still holds active accounts in production systems, because nothing compares the two units’ account lists. Which problem, and which fix, match this situation?

    A. A biometric enrollment failure; re-enroll the manager in the new unit B. Orphan accounts created by decentralized administration; add a central inventory and periodic reconciliation against an authoritative source C. A federation trust failure; exchange new metadata between the units D. An SSO token expiry; refresh the manager’s token

13. A network team must centrally authenticate device administrators, authorize each command they issue on network gear, record every command, and encrypt the entire exchange so the administrators’ commands are not readable on the wire. Which protocol fits best?

    A. RADIUS B. CHAP C. PAP D. TACACS+

14. In Kerberos per RFC 4120, after the Authentication Service has issued a ticket-granting ticket, what does the client present to the Ticket-Granting Service to obtain a ticket for a specific server?

    A. Its ticket-granting ticket B. Its password, encrypted with the server’s key C. A certificate signed by a public certification authority D. A biometric template captured at login

15. An attacker who has obtained the key material of the krbtgt account, the Key Distribution Center’s own account, forges ticket-granting tickets that name anyone they choose. What is the forged artifact called?

    A. A silver ticket B. A golden ticket C. A pass-the-hash replay D. A refresh token

16. A directory administrator discovers that network captures show the full LDAP bind exchange, including credential material, in cleartext between an application server and the directory. Which change closes the exposure?

    A. Add a second directory replica for failover B. Require longer bind passwords C. Reorganize the directory schema D. Use LDAPS on port 636, or STARTTLS to upgrade the connection per RFC 4513

17. A contractor’s engagement ended on a Friday, and the central directory account was disabled that day. Three weeks later, the contractor signs into a SaaS analytics platform, which maintains its own user list, with the old credentials. What is the primary missing control?

    A. Provisioning or scheduled reconciliation between the SaaS platform and the central identity store B. Multi-factor authentication on the SaaS platform C. A longer password policy for the SaaS platform D. Disabling the central account a second time

18. A company’s onboarding process creates a new employee’s accounts in the systems they need on day one, before the employee’s identity documents have been checked and their claim to the role verified. Which step, per the identity proofing guidance of NIST SP 800-63A-4, is missing?

    A. Credential rotation at hire B. Identity proofing before provisioning C. Session recording for the first week D. An access review at the end of the quarter

19. A service provider receives a SAML 2.0 assertion that arrived from the identity provider’s expected network address, but the provider does not check the signature, the validity window, or the audience. Which statement is correct?

    A. The network source is a sufficient basis for trust, because addresses are hard to spoof B. The assertion is safe because SAML assertions are encrypted by default C. The provider should verify the signature against the identity provider’s key, confirm the validity window, and confirm that the audience includes its own entity D. The provider should trust the user’s own claim about who they are

20. A native mobile app uses the OAuth 2.0 authorization code flow. An attacker intercepts the authorization code as it is returned to the app and attempts to exchange it at the authorization server using their own client. Which mechanism, added to the code exchange, is designed to defeat exactly this attack?

    A. PKCE, the Proof Key for Code Exchange of RFC 7636 B. A longer access token lifetime C. Logging every token request D. Rotating the client’s shared secret monthly

21. In OpenID Connect, which statement correctly distinguishes the ID token from the access token?

    A. The ID token grants access to protected resources, and the access token identifies the user B. Both tokens are bearer credentials, so they have identical roles C. The ID token is a signed statement of who the user is, and the access token grants access to APIs D. The access token is issued by the resource server, and the ID token by the client

22. A developer signs a JSON Web Token per RFC 7519, and a colleague inspects it. The token has three segments: header, payload, signature. Over which content is the signature computed?

    A. The payload only B. The expiry claim only C. A separate key exchange handshake D. The header and the payload

23. An organization wants its SaaS applications to receive user and group records, including deprovisioning events, automatically over a standard REST and JSON interface, so a terminated employee cannot survive in an application that never learns. Which standard provides this?

    A. SAML 2.0 B. SCIM, per RFC 7643 and RFC 7644 C. Kerberos D. RADIUS

24. A database administrator needs elevated rights for a two-hour migration window on Sunday, after which the rights should no longer exist. Which privileged access management practice matches the requirement?

    A. Standing membership in the database administrators group B. A shared database administrator password rotated monthly C. Just-in-time access that grants the elevation for the window and expires it afterward D. Routine use of the break-glass account for every migration

25. An organization must let a partner company’s users access its web portal through the partner’s own identity system, and it must also let a mobile app access its own APIs with scoped permissions. Which pair of standards fits best?

    A. Kerberos for the partner federation and SCIM for the mobile app B. LDAP for the partner federation and RADIUS for the mobile app C. SAML 2.0 for both, since the portal and the app both authenticate users D. SAML 2.0 for the partner web federation and OpenID Connect for the mobile app and API access

Answer key

Rationales

1. D. The difference between the two views is decided after the user is proven to be who they claim: the application checks which roles the proven identity holds and shows the approval queue only to users whose roles include it. That is authorization, the decision about what a proven identity may do. Identification and authentication happened earlier, at the sign-in, and accountability would come later, when the approval is recorded and attributed to the user. The roles are not a step in the identity process; they are the basis of the authorization decision.

2. B. The password is something you know and the hardware token is something you have, two different categories of evidence, so the scheme is two-factor authentication. The independence of the categories is the security property: an attacker who phishes the password cannot generate the token’s codes, and a thief who steals the token does not know the password. A scheme is single-factor only when every piece of evidence comes from the same category, and inherence, something you are, does not apply to a changing code.

3. D. NIST SP 800-63B directs verifiers to screen new secrets against lists of known compromised values, to allow long secrets so passphrases are possible, and to rate-limit or otherwise slow guessing attempts. All three target credential stuffing and password spraying directly: the attacker’s stolen lists stop working against accounts that were never issued those secrets, and rate limiting makes bulk guessing impractical. Composition rules with forced rotation (option A) push users into predictable patterns and do nothing to stop a replayed secret; reversible storage (option B) turns a database breach into plaintext credentials and is explicitly out; an age-based rule (option C) does nothing about a secret that was compromised yesterday.

4. A. Raising the acceptance threshold means the biometric sample must resemble the stored template more closely to be accepted. Fewer impostor attempts cross the higher bar, so the false accept rate falls, and more genuine attempts fall short of it, so the false reject rate rises. FAR and FRR move in opposite directions as the threshold moves, which is the trade at the heart of biometric tuning, and neither rate is a fixed property of the sensor.

5. A. Blocking the switch port until the device completes an authentication exchange with a central server, carried by the Extensible Authentication Protocol over LAN frames, is IEEE 802.1X port-based network access control: the port stays blocked until the supplicant authenticates. Kerberos ticket renewal is an identity protocol, not a port gate; MAC flooding is an attack, not a control; and dual control is a two-person rule that has nothing to do with port state.

6. B. FIPS 201 defines the PIV card for federal identity: a tamper-resistant card whose private key is generated on the card and never leaves it. The card is something you have, and the PIN is something you know, two different categories of evidence, which is what makes the combination two-factor authentication. If both pieces of evidence came from the same category, a single compromise could carry both; here, stealing the card without the PIN, or learning the PIN without the card, is insufficient. Nothing about the user’s body is measured, so inherence does not apply.

7. A. Access is granted by the system from the relationship between labels and clearances, and users cannot change the labels or override the decision: that is the signature of mandatory access control, the model associated with classified environments and enforced label policies. DAC lets the object owner decide, RBAC routes decisions through roles, and rule-based applies system-wide conditions, none of which describes a clearance-versus-label system with no owner override.

8. D. The folder creator, the owner, decides who may access and can pass the granting power on, which is discretionary access control: the owner’s discretion is the mechanism, and grants can propagate. MAC would make the system decide regardless of the owner, ABAC would evaluate attributes and policies, and lattice-based describes the ordering structure of a label space, not owner-granted permissions on a file share.

9. A. The ANSI RBAC standard INCITS 359-2004 formalizes separation of duty constraints as part of the model: mutually exclusive roles, structured so that no single user can be assigned the roles that would allow both halves of a sensitive process. Splitting approval and disbursement into separate, mutually exclusive roles is the standard implementation. A combined role with training, direct per-person grants outside the role structure, or after-the-fact logging all leave the conflict in place.

10. C. The decision combines attributes of the subject, the object, and the environment, the time, evaluated against a policy, which is the definition of attribute-based access control per NIST SP 800-162. DAC is owner discretion, MAC is labels and clearances, and lattice-based describes the ordering structure of a label space, not a department-and-time rule.

11. C. The analyst’s role grants the actions the job legitimately needs, read access to incident records, but it grants that read to every record, including cases the analyst has no reason to see. That is a need-to-know failure: access to data is not limited to what the task requires. Least privilege (option A) bounds the set of actions, not the set of data, and the analyst’s actions are within the role. Separation of duties and dual control divide sensitive operations among people; they do not limit data reach.

12. B. Each unit runs its own accounts, and the transferred manager’s old accounts survive because nothing reconciles the two stores. Orphan accounts, accounts whose owners no longer have a reason to exist in the source of truth, are the classic product of decentralized administration. The fix is a central inventory plus periodic reconciliation against an authoritative source, so a survival is noticed and removed. Biometrics, federation metadata, and token expiry describe other failure modes with other fixes.

13. D. TACACS+, published as RFC 8907, separates authentication, authorization, and accounting, supports per-command authorization, and encrypts the entire exchange, which matches every stated requirement. RADIUS, defined in RFC 2865, encrypts only the password and selected attributes and is the standard for network-access authentication at scale, not per-command device administration. CHAP is a challenge-response authentication method, not an AAA protocol, and PAP is the cleartext password method that exists as a cautionary example.

14. A. The client proves itself to the Authentication Service once and receives a ticket-granting ticket; it then presents the TGT to the Ticket-Granting Service to request service tickets for specific servers. The password never crosses the network in Kerberos, certificates are not part of the ticket flow, and biometrics play no role in the protocol. This two-exchange shape is the Kerberos design of RFC 4120.

15. B. A forged ticket-granting ticket minted with the krbtgt account’s key material is the golden ticket, and it lets the attacker impersonate anyone, even accounts that do not exist, until the krbtgt password is reset. The silver ticket is the smaller forgery, a service ticket for a specific service; pass-the-hash reuses a captured password hash to authenticate; and a refresh token is an OAuth object.

16. D. LDAP does not encrypt by default: plain LDAP on port 389 carries the bind exchange in the clear. LDAPS wraps the session in TLS on port 636, and STARTTLS, per RFC 4513, upgrades a plaintext connection on 389 to TLS at the client’s request. Replicas, longer passwords, and schema changes leave the transport exposure untouched.

17. A. The central directory was updated, but the SaaS platform keeps its own user table, so the revocation never reached the platform that actually admitted the contractor. The missing control is the provisioning channel, SCIM-driven or a scheduled reconciliation, that propagates identity changes to applications, so the platform’s copy of the user is removed or disabled. MFA and password strength are authentication-layer controls that do not remove an account that should not exist, and disabling the central account again does nothing, because the central account was not the entry point.

18. B. NIST SP 800-63A-4 frames identity proofing as the step that establishes who the person is and that they are the owner of the evidence, and it belongs before enrollment: proofing before provisioning. Creating accounts for an unverified person is how a ghost identity enters the estate, and the joiner moment inherits every downstream decision. Rotation, session recording, and quarterly reviews address later stages of the lifecycle, not the birth of the identity.

19. C. A SAML assertion’s trust anchors on the identity provider’s signature, verified against the key exchanged through metadata, plus the validity window and the audience restriction that names the intended service provider. The SP validates all three before creating a session. Network provenance is spoofable and is no substitute, SAML assertions are signed but not encrypted by default, and the user’s self-stated identity is exactly what the assertion exists to replace.

20. A. PKCE, the Proof Key for Code Exchange of RFC 7636, has the client generate a verifier and send a challenge derived from it; the code exchange must then prove knowledge of the verifier, so an attacker who intercepts the code cannot redeem it with their own client. A longer token lifetime, logging, and rotating the client secret do not protect the code exchange itself.

21. C. In OpenID Connect, the ID token is a signed JWT that tells the client who the user is, validated for signature, issuer, audience, and freshness, while the access token is the credential that grants access to protected APIs. The roles are not interchangeable: using an access token as proof of identity, or an ID token as an API grant, is a category error the exam is built to punish. The resource server issues neither token, and the client issues none of them.

22. D. A JWT’s signature is computed over the encoded header and the encoded payload with the signing key, per RFC 7519. A verifier checks the signature over the full content, which is what makes both segments tamper-evident. Signing only the payload, or only one claim, would leave the rest of the token free to be altered without detection, and there is no key exchange inside a JWT.

23. B. SCIM, the System for Cross-domain Identity Management, standardizes identity provisioning over REST and JSON, with /Users and /Groups resource types per RFC 7643 and RFC 7644, so user and group records, including deprovisioning events, propagate to applications automatically. SAML carries assertions about authentication, Kerberos authenticates within a trusted domain, and RADIUS handles network access; none of them creates or deletes accounts.

24. C. Just-in-time access grants privilege for a defined task and a limited window and removes it when the window closes, which is exactly a two-hour elevation for a Sunday migration. Standing membership keeps the rights permanently, a shared password rotated monthly still hands everyone the same standing secret, and routine break-glass use turns the emergency path into the normal path, which defeats the point of the exception. The management obligation underneath is ISO/IEC 27001:2022 Annex A control A.8.2: privileged access rights restricted and managed.

25. D. SAML 2.0 is the mature standard for cross-organization web federation, where the partner keeps its own identity store and the portal consumes its assertions. OpenID Connect, built on OAuth 2.0, is the fit for a native mobile app that needs scoped API access and a signed ID token. Kerberos and LDAP stay inside a trusted boundary, SCIM provisions rather than authenticates, and forcing SAML into the mobile app would push an XML assertion into an API authorization flow that OAuth was built for.

Reading your Domain 5 score

Score yourself against the bands this book set in Chapter 1 for every domain test:

The single number hides the information you need, so break the misses down by area. Domain 5 is several disciplines under one label, and the triage that matters is at the topic level:

Two habits make the score useful. First, log the result and the area misses on your score sheet, because the full practice exam in Chapter 33 will re-test this domain and you want the comparison. Second, treat a miss pattern as a question about process, not just facts. If your misses cluster on the questions that reward classification, the four-step questions and the model questions, your problem is classification speed, and the fix is to name the broken step or the gap before you look at the options. If your misses cluster on the questions with named standards, RFC 8907, RFC 7636, RFC 7519, your problem is source recall, and the fix is to redraw each standard’s structure cold, without the chapter open.

What the score means for your plan

Domain 5 carries 13 percent of the current outline’s weight, tied with security architecture and engineering and communication and network security for the second-largest share behind security and risk management. It is also the domain where the exam’s manager perspective shows most clearly: the correct answers are rarely the most technical ones, they are the ones that restore the broken step or close the named gap. The identity four-step and the four-gap diagnostic of Chapter 20 are decision instruments, not facts to memorize, and the questions that reward them are the ones that transfer to every other domain.

Identity decisions also underlie the rest of the book. Domain 7’s monitoring watches authentication events and privileged access, which are exactly the artifacts this test asked you to reason about. Domain 3’s architectures implement the access control models you classified here, and the software security chapters of Domain 8 test applications that implement OAuth flows and token validation. A candidate who passes this test has the vocabulary to reason about all of them, and a candidate who fails it has a precise list of which of the four gaps to rebuild.

One more thing worth noticing as you close Part VI: five of the eight domains are now behind you. The book’s domain material is past its midpoint, and the next part, Domain 6, Security Assessment and Testing, is the one where you stop learning new identity machinery and start measuring the systems that run it: the test types, the penetration test phases, the tools, and the evidence that makes a finding credible. Pass this test at the level your score band demands and move to Part VII with confidence. Fail it, and you have earned something rarer: a precise list of what to re-read, organized by the discipline that matters. Either way, the score sheet is now the authority on where your Domain 5 hours go.