ISSAP 26 > D3: CRYPTOGRAPHY > Flashcards

D3: CRYPTOGRAPHY Flashcards

(96 cards)

Study These Flashcards
1
Q

IAM architecture objective

A

Provide a coherent design so that the right subjects gain the right access to the right resources at the right time based on policy and risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Digital identity

A

Set of attributes that uniquely describes a subject such as a person device or service within a given context

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Authoritative source of identity

A

System of record that provides the most trusted identity data for a population such as human resources for employees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Identity lifecycle

A

Sequence from onboarding through changes to offboarding where identities and associated access must be created modified and removed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Joiner mover leaver process

A

Standard workflow that creates access for new users adjusts privileges when roles change and revokes access when users depart

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Identity proofing

A

Process of verifying that a person or entity is genuinely who they claim to be before issuing credentials or privileged access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Authentication

A

Process of verifying a claimed identity using one or more factors such as something known something possessed or something inherent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Authorization

A

Decision about what actions an authenticated subject is allowed to perform on which resources based on policies and attributes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Single sign on

A

Capability that enables a subject to authenticate once and then access multiple applications without repeated credential entry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Federated identity

A

Trust arrangement in which one domain authenticates a subject and passes assertions to another domain which relies on that information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Identity provider

A

Service that performs authentication and issues tokens or assertions containing identity information and claims

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Relying party

A

Application or service that consumes assertions or tokens from an identity provider and makes authorization decisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Claims based access control

A

Model where decisions are based on claims in tokens such as roles group membership or device posture rather than just identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Role based access control

A

Authorization model that assigns permissions to roles and then assigns users to roles to simplify entitlement management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Attribute based access control

A

Model that evaluates subject object action and environmental attributes against rules to reach fine grained decisions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Context aware access

A

Access control approach that considers contextual attributes such as location time risk score or device state when granting access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Directory service

A

Central repository that stores identity objects credentials groups and related attributes and supports lookup and authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Group and role design

A

Architectural activity of structuring groups and roles to reflect job functions segregation of duties and least privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Least privilege in IAM

A

Principle that access rights should be limited to the minimum necessary for subjects to perform their responsibilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Segregation of duties in IAM

A

Practice of ensuring no single identity has conflicting capabilities that together could enable significant fraud or error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Privileged account

A

Identity with elevated capabilities such as system administration configuration changes or wide data access requiring stronger controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Privileged access management

A

Set of processes and tools such as vaulting session control and just in time elevation that govern use of powerful accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Service account governance

A

Management of non human accounts including purpose scoping credential protection rotation and ownership

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Machine identity

A

Identity used by devices applications containers or services to authenticate to other components in machine to machine interactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Multifactor authentication
Authentication that uses at least two different factor types to significantly increase assurance in identity verification
26
Risk based authentication
Adaptive authentication that changes requirements based on evaluated risk such as demanding additional factors for unusual logins
27
Step up authentication
Mechanism that requires stronger authentication when a subject attempts higher risk actions or accesses more sensitive resources
28
Credential lifecycle
Phases through which credentials pass including issuance binding renewal revocation and expiration
29
Password policy
Set of rules governing complexity reuse storage and change of passwords while balancing usability and security
30
Passwordless authentication
Approach that replaces passwords with mechanisms such as hardware tokens biometrics or device bound credentials
31
Token based authentication
Use of security tokens such as JWT or SAML assertions that carry identity information and can be validated by resource servers
32
Session management
Creation maintenance and termination of authenticated sessions including timeouts renewal and protection against hijacking or fixation
33
Delegated administration
Design that allows limited administrative capabilities to be delegated to specific roles or units without granting full control
34
Identity governance and administration
Discipline and tooling that provide policy driven provisioning access reviews role management and reporting
35
Access certification
Periodic review process where managers or data owners confirm that identities still require their entitlements
36
Orphaned identity
Account that remains active without a valid owner or business justification often resulting from incomplete offboarding
37
Identity synchronization
Propagation of identity data and attributes between systems or directories to keep records consistent across environments
38
Hybrid identity
Architecture that integrates on premises directories with cloud identity services to provide seamless access across both
39
External or partner identity
Mechanisms for granting controlled access to users from other organizations often using federation or guest accounts
40
Customer identity and access management
Scalable IAM capabilities tailored for external customers including registration consent privacy and self service
41
Device identity in IAM
Assignment of credentials to devices so policies can require compliant trusted devices in addition to user authentication
42
Policy decision point
Logical component that evaluates access requests against policies and attributes and returns permit or deny decisions
43
Policy enforcement point
Component that intercepts access requests and enforces decisions from the policy decision point
44
Access request workflow
Process through which users request access approvals are captured and entitlements are granted and documented
45
Identity analytics
Use of data analysis and machine learning to detect anomalous identity and access patterns that may indicate risk
46
Directory segmentation
Design where different identity stores or partitions are used for separate populations or trust levels such as internal vs external users
47
Audit and logging for IAM
Recording key events such as logons failures changes to roles and provisioning actions to support accountability and forensics
48
IAM reference architecture
Standardized pattern that defines identity stores connectors authentication services and integration methods for the enterprise
49
IAM architecture objective
Provide a coherent design so that the right subjects gain the right access to the right resources at the right time based on policy and risk
50
Digital identity
Set of attributes that uniquely describes a subject such as a person device or service within a given context
51
Authoritative source of identity
System of record that provides the most trusted identity data for a population such as human resources for employees
52
Identity lifecycle
Sequence from onboarding through changes to offboarding where identities and associated access must be created modified and removed
53
Joiner mover leaver process
Standard workflow that creates access for new users adjusts privileges when roles change and revokes access when users depart
54
Identity proofing
Process of verifying that a person or entity is genuinely who they claim to be before issuing credentials or privileged access
55
Authentication
Process of verifying a claimed identity using one or more factors such as something known something possessed or something inherent
56
Authorization
Decision about what actions an authenticated subject is allowed to perform on which resources based on policies and attributes
57
Single sign on
Capability that enables a subject to authenticate once and then access multiple applications without repeated credential entry
58
Federated identity
Trust arrangement in which one domain authenticates a subject and passes assertions to another domain which relies on that information
59
Identity provider
Service that performs authentication and issues tokens or assertions containing identity information and claims
60
Relying party
Application or service that consumes assertions or tokens from an identity provider and makes authorization decisions
61
Claims based access control
Model where decisions are based on claims in tokens such as roles group membership or device posture rather than just identity
62
Role based access control
Authorization model that assigns permissions to roles and then assigns users to roles to simplify entitlement management
63
Attribute based access control
Model that evaluates subject object action and environmental attributes against rules to reach fine grained decisions
64
Context aware access
Access control approach that considers contextual attributes such as location time risk score or device state when granting access
65
Directory service
Central repository that stores identity objects credentials groups and related attributes and supports lookup and authentication
66
Group and role design
Architectural activity of structuring groups and roles to reflect job functions segregation of duties and least privilege
67
Least privilege in IAM
Principle that access rights should be limited to the minimum necessary for subjects to perform their responsibilities
68
Segregation of duties in IAM
Practice of ensuring no single identity has conflicting capabilities that together could enable significant fraud or error
69
Privileged account
Identity with elevated capabilities such as system administration configuration changes or wide data access requiring stronger controls
70
Privileged access management
Set of processes and tools such as vaulting session control and just in time elevation that govern use of powerful accounts
71
Service account governance
Management of non human accounts including purpose scoping credential protection rotation and ownership
72
Machine identity
Identity used by devices applications containers or services to authenticate to other components in machine to machine interactions
73
Multifactor authentication
Authentication that uses at least two different factor types to significantly increase assurance in identity verification
74
Risk based authentication
Adaptive authentication that changes requirements based on evaluated risk such as demanding additional factors for unusual logins
75
Step up authentication
Mechanism that requires stronger authentication when a subject attempts higher risk actions or accesses more sensitive resources
76
Credential lifecycle
Phases through which credentials pass including issuance binding renewal revocation and expiration
77
Password policy
Set of rules governing complexity reuse storage and change of passwords while balancing usability and security
78
Passwordless authentication
Approach that replaces passwords with mechanisms such as hardware tokens biometrics or device bound credentials
79
Token based authentication
Use of security tokens such as JWT or SAML assertions that carry identity information and can be validated by resource servers
80
Session management
Creation maintenance and termination of authenticated sessions including timeouts renewal and protection against hijacking or fixation
81
Delegated administration
Design that allows limited administrative capabilities to be delegated to specific roles or units without granting full control
82
Identity governance and administration
Discipline and tooling that provide policy driven provisioning access reviews role management and reporting
83
Access certification
Periodic review process where managers or data owners confirm that identities still require their entitlements
84
Orphaned identity
Account that remains active without a valid owner or business justification often resulting from incomplete offboarding
85
Identity synchronization
Propagation of identity data and attributes between systems or directories to keep records consistent across environments
86
Hybrid identity
Architecture that integrates on premises directories with cloud identity services to provide seamless access across both
87
External or partner identity
Mechanisms for granting controlled access to users from other organizations often using federation or guest accounts
88
Customer identity and access management
Scalable IAM capabilities tailored for external customers including registration consent privacy and self service
89
Device identity in IAM
Assignment of credentials to devices so policies can require compliant trusted devices in addition to user authentication
90
Policy decision point
Logical component that evaluates access requests against policies and attributes and returns permit or deny decisions
91
Policy enforcement point
Component that intercepts access requests and enforces decisions from the policy decision point
92
Access request workflow
Process through which users request access approvals are captured and entitlements are granted and documented
93
Identity analytics
Use of data analysis and machine learning to detect anomalous identity and access patterns that may indicate risk
94
Directory segmentation
Design where different identity stores or partitions are used for separate populations or trust levels such as internal vs external users
95
Audit and logging for IAM
Recording key events such as logons failures changes to roles and provisioning actions to support accountability and forensics
96
IAM reference architecture
Standardized pattern that defines identity stores connectors authentication services and integration methods for the enterprise
ISSAP 26
flashcards
Decks in class (12)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions