4.6 Given a scenario, implement and maintain identity and access management
Objective 4.6 sits in Security Operations, which carries 28% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A new IT administrator only needs to reset passwords for one department. The identity team provisions them with a permanent Global Administrator role because it is faster than researching a narrower role. Which approach should have been used instead?
The concept
Least privilege in provisioning means granting a specific set of permissions, over a specific scope, for a specific period of time, rather than a broad standing role.
Why this answer
Provisioning a permanent Global Administrator role for a narrow task grants far more permission, scope, and duration than needed, which is exactly what least privilege provisioning avoids.
- Correct: this is the full definition of least privilege provisioning as applied here.
- BDeny by default addresses unmatched access requests, not how an existing role assignment is scoped.
- CThis describes just-in-time activation, one piece of least privilege but not the whole practice being violated.
- DThis describes attribute-based access control, a different model, not the least privilege scoping issue.
- EUsing a group changes who manages the assignment, not whether the permissions and duration are minimized.
Now you: objective 4.6 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An organization keeps two cloud-only accounts permanently assigned the Global Administrator role, excluded from normal daily use, reserved only for situations where all other administrators are accidentally locked out. What are these accounts called?
Sample question 2 of 3
A help desk technician's on-premises directory account, synchronized to the cloud directory, is assigned a cloud administrator role. The on-premises account is later compromised through a phishing attack. What risk does this illustrate for privileged role assignments?
Sample question 3 of 3
An intranet application for a small internal engineering team requires each employee to install a personal certificate on their browser and present it during the TLS handshake, in addition to a username and password. What is this approach, and where is it appropriate to use?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Operations
- 4.1 4.1 Given a scenario, apply common security techniques to computing resources
- 4.2 4.2 Explain the security implications of proper hardware, software, and data asset management
- 4.3 4.3 Explain various activities associated with vulnerability management
- 4.7 4.7 Explain the importance of automation and orchestration related to secure operations
- 4.8 4.8 Explain appropriate incident response activities
- 4.9 4.9 Given a scenario, use data sources to support an investigation