IncludeHelp_logo
Skip Navigation Links
×

Trending Technologies MCQs

Home » Trending Technologies MCQs

Identity and Access Management (IAM) MCQs (Multiple-Choice Questions)

Identity and Access Management (IAM) is a cybersecurity discipline that manages digital identities and controls access to applications, systems, networks, and data. These Identity and Access Management MCQs are designed to help learners understand authentication, authorization, access control models, identity lifecycle management, single sign-on, multifactor authentication, and other essential IAM concepts.

Identity and Access Management (IAM) MCQs

Identity and Access Management provides a framework for determining who can access an organization's resources and what actions they are permitted to perform. It combines identity verification, access policies, user provisioning, and account management to protect sensitive information from unauthorized access.

Practicing these multiple-choice questions helps students, IT professionals, cybersecurity beginners, and certification candidates assess their knowledge of IAM technologies and security principles. The questions cover fundamental concepts as well as practical situations involving permissions, authentication methods, identity federation, and privileged accounts.

List of Identity and Access Management (IAM) MCQs

The following questions cover identity management, authentication and authorization, role-based and attribute-based access control, least privilege, multifactor authentication, single sign-on, SAML, OAuth 2.0, OpenID Connect, directory services, identity federation, provisioning, deprovisioning, privileged access management, and IAM security scenarios. Each question includes four options, the correct answer, and an explanation.

1. What is the primary purpose of Identity and Access Management (IAM)?

  1. To increase network bandwidth
  2. To manage digital identities and control access to resources
  3. To replace all encryption technologies
  4. To eliminate the need for security policies

Answer: B) To manage digital identities and control access to resources

Explanation:

IAM manages digital identities and determines which users or systems can access particular resources. It helps organizations enforce access policies and protect sensitive information.

2. Which IAM process verifies that a user is who they claim to be?

  1. Authorization
  2. Provisioning
  3. Authentication
  4. Auditing

Answer: C) Authentication

Explanation:

Authentication verifies an identity using credentials such as passwords, security keys, certificates, or biometric characteristics. Authorization determines what an authenticated identity is allowed to do.

3. What does authorization determine in an IAM system?

  1. Whether an identity can perform a requested action
  2. Whether a server has enough memory
  3. Whether a password was created recently
  4. Whether a network cable is connected

Answer: A) Whether an identity can perform a requested action

Explanation:

Authorization evaluates permissions and access policies to decide whether a user or system can perform an operation on a resource. For example, a user may view a document but may not be permitted to delete it.

4. Which principle requires users to receive only the permissions necessary for their responsibilities?

  1. Open access
  2. Complete trust
  3. Maximum privilege
  4. Principle of least privilege

Answer: D) Principle of least privilege

Explanation:

The principle of least privilege limits each identity to the minimum access needed to perform its assigned tasks. This reduces the potential damage caused by compromised accounts or accidental actions.

5. Which access control model assigns permissions according to predefined job roles?

  1. Discretionary Access Control (DAC)
  2. Role-Based Access Control (RBAC)
  3. Mandatory Access Control (MAC)
  4. Attribute-Based Access Control (ABAC)

Answer: B) Role-Based Access Control (RBAC)

Explanation:

RBAC associates permissions with organizational roles, such as administrator, accountant, or support agent. Users receive permissions through the roles assigned to them.

6. What is the main characteristic of Attribute-Based Access Control (ABAC)?

  1. It grants access only through passwords
  2. It assigns every user identical permissions
  3. It evaluates attributes of users, resources, actions, and the environment
  4. It prevents access to all external applications

Answer: C) It evaluates attributes of users, resources, actions, and the environment

Explanation:

ABAC makes access decisions using attributes such as department, resource classification, requested action, location, and time. Policies can combine these attributes to support context-sensitive access decisions.

7. What is Single Sign-On (SSO)?

  1. A mechanism that lets users access multiple supported applications through one authentication session
  2. A method that requires a separate password for every application
  3. A process for removing inactive accounts
  4. A technique for encrypting database backups

Answer: A) A mechanism that lets users access multiple supported applications through one authentication session

Explanation:

SSO allows a user to authenticate through an identity provider and access multiple connected applications without separately signing in to each one. Applications must support or trust the relevant SSO arrangement.

8. Which option is an example of multifactor authentication (MFA)?

  1. Using two different passwords
  2. Using a username and a password only
  3. Entering the same password twice
  4. Using a password and a hardware security key

Answer: D) Using a password and a hardware security key

Explanation:

MFA requires authentication factors from at least two distinct categories, such as something the user knows and something the user possesses. A password and a hardware security key represent different factor categories.

9. Which of the following is an example of something a user knows?

  1. A fingerprint
  2. A password
  3. A hardware token
  4. A registered smartphone

Answer: B) A password

Explanation:

A password is a knowledge factor because the user must know it to authenticate. Fingerprints are inherence factors, while hardware tokens and registered devices can serve as possession factors.

10. Which protocol is commonly used to exchange authentication assertions between an identity provider and an enterprise application?

  1. FTP
  2. DHCP
  3. SAML
  4. SNMP

Answer: C) SAML

Explanation:

Security Assertion Markup Language (SAML) is commonly used for federated authentication and enterprise SSO. It enables an identity provider to issue signed assertions that a service provider can validate.

11. What is the primary role of an identity provider (IdP)?

  1. To authenticate identities and provide identity-related assertions or tokens
  2. To manufacture network hardware
  3. To replace every application database
  4. To store all company files in plaintext

Answer: A) To authenticate identities and provide identity-related assertions or tokens

Explanation:

An identity provider authenticates users or other identities and supplies information that relying applications can use to establish an authenticated session. Depending on the protocol, this information may be delivered through assertions or tokens.

12. Which standard adds an authentication and identity layer on top of OAuth 2.0?

  1. LDAP
  2. Kerberos
  3. RADIUS
  4. OpenID Connect (OIDC)

Answer: D) OpenID Connect (OIDC)

Explanation:

OpenID Connect builds an identity layer on OAuth 2.0. It enables a client to verify an end user's identity and obtain standardized identity claims, commonly through an ID token.

13. What is the primary purpose of OAuth 2.0?

  1. To define how passwords must be stored in every database
  2. To provide a framework for delegated authorization
  3. To physically secure data centers
  4. To replace all directory services

Answer: B) To provide a framework for delegated authorization

Explanation:

OAuth 2.0 enables an application to obtain limited access to protected resources on behalf of a resource owner or under another authorized grant. OAuth 2.0 alone is not an authentication protocol.

14. What is the purpose of a directory service in IAM?

  1. To compress all network traffic
  2. To automatically remove every user account
  3. To organize and provide access to identity and directory information
  4. To replace multifactor authentication

Answer: C) To organize and provide access to identity and directory information

Explanation:

A directory service stores and organizes information about users, groups, devices, and other objects. Organizations use directory services to support authentication, account lookup, and centralized identity administration.

15. Which protocol is commonly used to access and manage information in directory services?

  1. LDAP
  2. SMTP
  3. ICMP
  4. RTP

Answer: A) LDAP

Explanation:

Lightweight Directory Access Protocol (LDAP) provides a standardized way to query and modify directory information. Secure deployments protect LDAP communication using appropriate transport security, such as LDAPS or StartTLS.

16. What does identity provisioning mean?

  1. Encrypting every file on a workstation
  2. Checking the physical temperature of a server
  3. Replacing all user passwords every day
  4. Creating accounts and assigning the required access to identities

Answer: D) Creating accounts and assigning the required access to identities

Explanation:

Identity provisioning establishes accounts and configures the permissions required for a person, service, or device. It may be triggered by hiring, a role change, or the deployment of a new application.

17. What is identity deprovisioning?

  1. Adding administrator privileges to all accounts
  2. Removing or disabling accounts and access that are no longer required
  3. Creating additional authentication factors
  4. Registering a new domain name

Answer: B) Removing or disabling accounts and access that are no longer required

Explanation:

Deprovisioning revokes access when an identity is no longer entitled to use organizational resources. Timely deprovisioning after termination or contract completion reduces the risk of unauthorized access.

18. What is the purpose of an identity lifecycle management process?

  1. To manage only the creation of passwords
  2. To maintain network cabling diagrams
  3. To manage identities and their access from creation through modification and retirement
  4. To eliminate periodic access reviews

Answer: C) To manage identities and their access from creation through modification and retirement

Explanation:

Identity lifecycle management governs how identities and their permissions change over time. It includes onboarding, role changes, access reviews, and offboarding.

19. Which IAM practice helps identify permissions that users no longer need?

  1. Periodic access review
  2. Unrestricted account sharing
  3. Disabling audit logs
  4. Permanent privilege escalation

Answer: A) Periodic access review

Explanation:

Periodic access reviews allow managers or resource owners to verify that existing permissions remain appropriate. Unnecessary or excessive access can then be removed.

20. What is privileged access management (PAM) designed to control?

  1. Access to public websites by anonymous visitors
  2. Only ordinary email subscriptions
  3. Physical office lighting schedules
  4. Elevated access to critical systems and sensitive resources

Answer: D) Elevated access to critical systems and sensitive resources

Explanation:

PAM protects high-impact accounts and privileged sessions, including administrator and root access. Common controls include credential vaulting, approval workflows, session monitoring, and time-limited privilege elevation.

21. What does the principle of separation of duties help prevent?

  1. All forms of user authentication
  2. A single person from having incompatible responsibilities without appropriate oversight
  3. Every user from accessing business applications
  4. All changes to organizational data

Answer: B) A single person from having incompatible responsibilities without appropriate oversight

Explanation:

Separation of duties divides sensitive tasks among multiple people or roles. For example, one employee may create a payment while another must approve it, reducing opportunities for fraud and mistakes.

22. Which access control model allows the resource owner to decide who can access a resource?

  1. Mandatory Access Control (MAC)
  2. Role-Based Access Control (RBAC)
  3. Discretionary Access Control (DAC)
  4. Rule-Based Routing

Answer: C) Discretionary Access Control (DAC)

Explanation:

DAC allows an owner or authorized controller of a resource to grant or revoke permissions. The owner may decide which users or groups can read, modify, or execute the resource.

23. Which access control model commonly enforces centrally defined security labels and classifications?

  1. Mandatory Access Control (MAC)
  2. Discretionary Access Control (DAC)
  3. Open Access Control
  4. Unrestricted Role Assignment

Answer: A) Mandatory Access Control (MAC)

Explanation:

MAC enforces access decisions using centrally administered security policies, often involving security labels and clearance levels. Individual resource owners generally cannot override those mandatory restrictions.

24. What is identity federation?

  1. A method of physically connecting two data centers
  2. A system for creating identical passwords for every user
  3. A backup process for directory databases
  4. An arrangement that enables identities authenticated by one trusted domain to be recognized by another

Answer: D) An arrangement that enables identities authenticated by one trusted domain to be recognized by another

Explanation:

Identity federation establishes trust between separate identity domains or organizations. It enables users to access external applications or services using identities managed by a trusted identity provider.

25. Which security mechanism can help resist phishing by using a cryptographic challenge tied to the legitimate website?

  1. A reusable password sent through email
  2. A FIDO2/WebAuthn passkey
  3. A shared administrator account
  4. An unverified password reset link

Answer: B) A FIDO2/WebAuthn passkey

Explanation:

Passkeys use public-key cryptography and are bound to the legitimate relying party's domain. This design helps prevent credentials from being used on lookalike phishing websites.

26. What is the main security benefit of adaptive authentication?

  1. It removes the need to identify users
  2. It gives every account permanent administrator rights
  3. It adjusts authentication requirements based on risk and contextual signals
  4. It disables security checks when a device is unfamiliar

Answer: C) It adjusts authentication requirements based on risk and contextual signals

Explanation:

Adaptive authentication evaluates signals such as device state, location, network characteristics, and unusual behavior. A high-risk sign-in may trigger stronger verification or be blocked.

27. Which IAM component can centralize authentication and access policies for multiple applications?

  1. An identity and access management platform
  2. A standalone image editor
  3. A printer driver
  4. A spreadsheet formatting tool

Answer: A) An identity and access management platform

Explanation:

An IAM platform can centralize identity administration, authentication, policy enforcement integrations, and access reporting across supported applications. The exact capabilities depend on the product and deployment.

28. What is a service account primarily used for?

  1. Allowing every employee to share one personal login
  2. Replacing all human user identities
  3. Providing unrestricted access to the internet
  4. Representing an application, service, or automated process that needs access to resources

Answer: D) Representing an application, service, or automated process that needs access to resources

Explanation:

Service accounts represent non-human workloads, such as applications, scheduled jobs, or integrations. They should have narrowly scoped permissions, controlled credentials, and appropriate monitoring.

29. Which approach is generally preferable to embedding long-lived credentials directly in application source code?

  1. Publishing credentials in documentation
  2. Using a secrets manager or an appropriate workload identity mechanism
  3. Sharing credentials in public repositories
  4. Reusing an employee's personal password

Answer: B) Using a secrets manager or an appropriate workload identity mechanism

Explanation:

Secrets managers and workload identity mechanisms reduce exposure of sensitive credentials in source code. They can support controlled access, rotation, and auditing, depending on the implementation.

30. What is the purpose of a JSON Web Token (JWT) in an IAM-related system?

  1. To guarantee that all network traffic is anonymous
  2. To replace every access control policy
  3. To carry claims in a structured token that can be verified according to its security configuration
  4. To store passwords in readable form

Answer: C) To carry claims in a structured token that can be verified according to its security configuration

Explanation:

A JWT can carry claims about an identity or authorization context. A signed JWT provides integrity protection when correctly validated, but its payload is not necessarily encrypted and must not be assumed confidential.

31. Why should access tokens have limited lifetimes?

  1. To reduce the period during which a stolen token may remain usable
  2. To prevent applications from recording events
  3. To ensure that tokens can never be stolen
  4. To remove the need for authorization checks

Answer: A) To reduce the period during which a stolen token may remain usable

Explanation:

Shorter token lifetimes limit the time available to misuse a compromised token. Expiration does not eliminate all risk, so secure storage, appropriate scopes, validation, and revocation strategies remain important.

32. What is the primary purpose of a refresh token in an OAuth-based system?

  1. To encrypt a user's entire hard drive
  2. To assign a new job title to a user
  3. To replace the identity provider's security policies
  4. To obtain new access tokens under the authorization server's rules

Answer: D) To obtain new access tokens under the authorization server's rules

Explanation:

A refresh token can be exchanged for a new access token without repeating the full authorization process, when permitted. Refresh tokens are sensitive credentials and require secure storage, appropriate rotation, and revocation controls.

33. What is the main purpose of access certification in IAM?

  1. To verify that all employee devices have the same model number
  2. To confirm that users' existing permissions are justified and appropriate
  3. To generate new passwords for public websites
  4. To disable all accounts on a fixed schedule

Answer: B) To confirm that users' existing permissions are justified and appropriate

Explanation:

Access certification is a formal review in which designated reviewers approve, modify, or revoke assigned permissions. It supports least privilege, accountability, and compliance requirements.

34. What is just-in-time (JIT) access in privileged identity management?

  1. Permanent administrator access for all staff
  2. Access that never expires
  3. Privilege granted only when needed, usually for a limited period
  4. Access that bypasses all approvals and logs

Answer: C) Privilege granted only when needed, usually for a limited period

Explanation:

JIT access grants elevated permissions for a defined task or time window rather than leaving them permanently active. This reduces standing privileges and limits opportunities for misuse.

35. What is a major risk of shared user accounts?

  1. Reduced accountability because actions may not be attributable to a specific person
  2. Automatic enforcement of least privilege
  3. Guaranteed prevention of credential theft
  4. Improved individual activity attribution in every case

Answer: A) Reduced accountability because actions may not be attributable to a specific person

Explanation:

Shared accounts make it harder to identify which person performed an action. Individual identities and appropriately configured logging improve accountability and incident investigation.

36. Which IAM control helps prevent a user from accessing an account after leaving an organization?

  1. Increasing the account's session duration
  2. Assigning additional application roles
  3. Allowing the former employee to retain a recovery method
  4. Promptly disabling the account and revoking relevant access

Answer: D) Promptly disabling the account and revoking relevant access

Explanation:

Offboarding should disable or remove the former employee's accounts, revoke active sessions and credentials where supported, and remove access to connected systems. Automated workflows help reduce delays and missed accounts.

37. What does the term "orphaned account" mean in IAM?

  1. An account with multifactor authentication enabled
  2. An account that no longer has a clear owner or valid business justification
  3. An account that belongs to a properly managed service
  4. An account that has been reviewed and approved recently

Answer: B) An account that no longer has a clear owner or valid business justification

Explanation:

An orphaned account may remain after an employee leaves, a service is retired, or ownership changes. Identifying and resolving these accounts helps reduce unauthorized access and improve accountability.

38. What is the function of a policy decision point (PDP) in an access control architecture?

  1. To physically lock server cabinets
  2. To create employee payroll records
  3. To evaluate access requests against applicable policies and make decisions
  4. To issue every user's personal computer

Answer: C) To evaluate access requests against applicable policies and make decisions

Explanation:

A policy decision point evaluates access requests using relevant policies, identity information, resource attributes, and context. A policy enforcement point applies the resulting decision to the request.

39. What is the purpose of a policy enforcement point (PEP)?

  1. To enforce access decisions for requests to protected resources
  2. To write all application source code
  3. To assign hardware serial numbers
  4. To eliminate the need for access policies

Answer: A) To enforce access decisions for requests to protected resources

Explanation:

A policy enforcement point intercepts or controls access to a resource and enforces the applicable decision, such as allowing or denying a request. It commonly works with a policy decision point.

40. Why is centralized identity logging important in IAM?

  1. It guarantees that no account will be compromised
  2. It makes access reviews unnecessary
  3. It permits users to bypass authentication controls
  4. It helps detect suspicious activity and investigate access-related incidents

Answer: D) It helps detect suspicious activity and investigate access-related incidents

Explanation:

Identity logs can record sign-ins, failed authentication attempts, permission changes, account creation, and privilege elevation. Centralized collection and monitoring help security teams identify anomalies and reconstruct events.

41. What is the purpose of risk-based access control?

  1. To allow every request regardless of its risk
  2. To make access decisions using the assessed risk associated with a request
  3. To assign permissions solely according to a user's display name
  4. To disable security monitoring during unusual activity

Answer: B) To make access decisions using the assessed risk associated with a request

Explanation:

Risk-based access control considers signals such as unusual login patterns, device posture, and resource sensitivity. Depending on the policy, the system may allow access, request additional verification, or deny the request.

42. What does Zero Trust mean in the context of IAM?

  1. Trusting all users inside the corporate network automatically
  2. Disabling identity verification for internal applications
  3. Verifying access explicitly and continuously evaluating relevant context rather than relying on network location alone
  4. Giving every authenticated user full administrative access

Answer: C) Verifying access explicitly and continuously evaluating relevant context rather than relying on network location alone

Explanation:

Zero Trust does not assume that an identity or device is trustworthy simply because it is inside a network perimeter. Access decisions should consider identity, device posture, resource sensitivity, and policy, with reassessment where appropriate.

43. Which IAM feature helps users recover access when they forget their passwords without requiring a help-desk agent for every request?

  1. Self-service password reset with appropriate identity verification
  2. Disabling account recovery controls
  3. Sharing a universal administrator password
  4. Removing authentication from user accounts

Answer: A) Self-service password reset with appropriate identity verification

Explanation:

Self-service password reset allows users to regain account access after completing configured verification steps. Strong recovery methods are essential because weak recovery processes can undermine otherwise strong authentication.

44. Why should an organization avoid granting every employee the administrator role?

  1. It prevents employees from signing in
  2. It makes every access request anonymous
  3. It guarantees that applications will fail
  4. It creates excessive privileges and increases the potential impact of compromised accounts

Answer: D) It creates excessive privileges and increases the potential impact of compromised accounts

Explanation:

Administrator privileges often permit sensitive configuration changes, data access, or account management. Assigning them broadly violates least privilege and can make security incidents much more damaging.

45. Which approach is most appropriate when a user changes departments within the same organization?

  1. Keep all previous permissions and add every new role
  2. Review the user's new responsibilities, grant required access, and remove obsolete permissions
  3. Create multiple unmanaged accounts without review
  4. Disable all security logging for the transition

Answer: B) Review the user's new responsibilities, grant required access, and remove obsolete permissions

Explanation:

A role change should trigger an access review. The organization should provision the permissions needed for the new role and revoke permissions that are no longer justified, preventing privilege accumulation.

46. Which statement about biometric authentication is correct?

  1. Biometric data should always be stored as plain text
  2. Biometrics cannot be used as an authentication factor
  3. Biometrics use physical or behavioral characteristics and require careful protection of biometric data
  4. A fingerprint automatically grants authorization to every resource

Answer: C) Biometrics use physical or behavioral characteristics and require careful protection of biometric data

Explanation:

Biometric authentication may use fingerprints, facial characteristics, or other measurable traits. Biometric data and matching systems require safeguards, and successful authentication does not automatically grant permission to every resource.

47. What is the main purpose of SCIM in identity management?

  1. To standardize the exchange of identity information and automate user provisioning across systems
  2. To replace encryption for all network connections
  3. To define physical security camera placement
  4. To provide a universal password shared by all applications

Answer: A) To standardize the exchange of identity information and automate user provisioning across systems

Explanation:

System for Cross-domain Identity Management (SCIM) provides standardized schemas and HTTP-based operations for managing identities across compatible systems. It can automate account creation, updates, and deactivation.

48. Which control is especially important for protecting IAM administrator accounts?

  1. Using the same password across all services
  2. Disabling alerts for privileged sign-ins
  3. Allowing permanent, unmonitored elevated access
  4. Enforcing strong phishing-resistant MFA where supported and monitoring privileged activity

Answer: D) Enforcing strong phishing-resistant MFA where supported and monitoring privileged activity

Explanation:

Administrator accounts can control critical systems and security settings. Phishing-resistant authentication, restricted privileges, separate administrative identities, and activity monitoring help protect these accounts.

49. An application grants access based only on a user's department, even when the requested resource is classified as confidential and the user lacks the required clearance. What is the main IAM weakness?

  1. The application uses a directory service
  2. The access policy ignores important resource and user attributes
  3. The user has a digital identity
  4. The organization uses authentication

Answer: B) The access policy ignores important resource and user attributes

Explanation:

An access policy that considers only department membership may grant excessive permissions. A stronger policy evaluates relevant attributes, including resource sensitivity and user clearance, before allowing access.

50. A company uses RBAC for its finance application. An employee moves from the Accounts Payable role to the Accounts Receivable role. The old role grants permission to approve supplier payments, while the new role requires access to customer invoices. What should the IAM system do?

  1. Keep both roles permanently to avoid interrupting work
  2. Grant the employee administrator privileges to simplify the transition
  3. Assign the Accounts Receivable role and remove obsolete Accounts Payable permissions, subject to the organization's policies
  4. Disable the employee's identity permanently

Answer: C) Assign the Accounts Receivable role and remove obsolete Accounts Payable permissions, subject to the organization's policies

Explanation:

RBAC associates permissions with job roles. When an employee changes roles, IAM should update role assignments to reflect the new responsibilities and remove permissions that are no longer required. This supports least privilege and reduces the risk of unauthorized supplier-payment approvals.

Comments and Discussions!

Load comments ↻



Top MCQs
Top Programs/Examples
Top Tutorials
About
Student's Section
Subscribe

Copyright © 2026 www.includehelp.com. All rights reserved.