Top IAM Interview Questions And Answers

Introduction

Identity and Access Management (IAM) is a crucial aspect of cybersecurity. It involves managing who has access to information and resources within an organization. IAM helps protect sensitive data from unauthorized users and reduces the risk of security breaches by ensuring that the right people have access at the right time. In an interview, understanding IAM demonstrates your knowledge of essential security practices and shows you can help safeguard the organization's assets. Employers value IAM skills because they are fundamental to maintaining a secure and compliant IT environment, which is critical in today's threat landscape.

Q1: Why Is IAM Important?

A: IAM (Identity and Access Management) is crucial because security threats are increasing, and it's getting harder to manage user privacy. IAM helps protect organizations of all sizes and industries. It's essential because passwords can be hacked quickly, data breaches happen often, and unauthorized people can enter government and private organizations.

Q2: What's The Difference Between An IAM Policy And An IAM Policy Document?

A: An IAM policy is a named set of rules that define what permissions are given. An IAM policy document is the actual file, usually in JSON or YAML format, that lists these rules. You can attach multiple policies to an IAM user, group, or role; each has its own document.

Q3: What Have Managed Policies And Inline Policies In AWS IAM?

A: Managed Policies: These are separate policies that can be attached to many users, groups, or roles. They are created and managed independently and can be shared across different AWS accounts.

Inline Policies: These are directly attached to a single user, group, or role. They are defined within the entity they are attached to and cannot be shared or reused outside of it.

Q4: What Is An Identity Directory Service?

A: An identity directory service usually involves working with active directories and other repositories that use the Lightweight Directory Access Protocol (LDAP). Therefore, LDAP skills are needed throughout the project for tasks like combining directories, testing, and converting data.

Q5: What Are Password Hashes And Password Cracking?

A: Hashing is one-way encryption using an algorithm with no key. When a user attempts to log in, the password they type is hashed, and that hash is compared against the hash stored on the system. The hash function cannot be reversed: it is impossible to reverse the algorithm and produce a password from a hash. While hashes may not be reversed, an attacker may run the hash algorithm forward many times, selecting various possible passwords and comparing the output to a desired hash, hoping to find a match (and deriving the original password). This is called password cracking.

Q6: What Are Salts?

A: A salt allows one password to hash multiple ways. Some systems (like modern UNIX/Linux systems) combine a salt with a password before hashing. While storing password hashes is superior to storing plaintext passwords, "The designers of the UNIX operating system improved on this method (hashing) by using a random value called a 'salt.' A salt value ensures that the same password will encrypt differently when used by different users. This method offers the advantage that an attacker must encrypt the same word multiple times (once for each salt or user) to mount a successful password-guessing attack.

Q7: How Does Centralized Access Control Work?

A: Centralized access control concentrates access control in one logical point for a system or organization. Instead of using local access control databases, systems authenticate via third-party authentication servers. Centralized access control can provide Single Sign-On (SSO), where a subject can authenticate once and access multiple systems. Centralized access control can centrally provide the three "A's" of access control: Authentication, Authorization, and Accountability.

• Authentication: proving an identity claim

• Authorization: actions authenticated subjects are allowed to perform on a system

• Accountability: the ability to audit a system and demonstrate the actions of subjects

Q8: What Are Some Features Of Password Management Security?

A: Typically, the minimum password management security features include the following:

• Password history = set to remember 24 passwords

• Maximum password age = 90 days

• Minimum password age = 2 days (this is because users do not cycle through 24 passwords to return immediately to their favorite)

• Minimum password length = 8 characters

• Passwords must meet complexity requirements = true.

• Store password using reversible encryption = false

Q9: How Does Decentralized Access Control Work?

A: Decentralized access control allows IT administration to occur closer to the organization's mission and operations. In decentralized access control, an organization spans multiple locations, and the local sites support and maintain independent systems, access control databases, and data. Decentralized access control is also called distributed access control.

This model provides more local power: each site has control over its data. This is empowering but carries risks. Different sites may employ different access control models, policies, and levels of security, leading to an inconsistent view. Even organizations with a uniform policy may find that adherence varies per site. An attacker will likely attack the weakest link in the chain: a small office with less trained staff makes a more tempting target than a central data center with experienced staff.

Q10: What Is Biometric Enrollment And Throughput?

A: Enrollment describes registering with a biometric system: creating an account for the first time. Users typically provide their username (identity), password, or PIN and then provide biometric information, such as swiping fingerprints on a fingerprint reader or photographing their irises. Enrollment is a one-time process that should take 2 minutes or less. Throughput describes the process of authenticating to a biometric system. This is also called the biometric system response time. A typical throughput is 6–10 seconds.

Q11: What Is Lightweight Directory Access Protocol (LDAP)?

A: Lightweight Directory Access Protocol (LDAP) is a common open protocol for interfacing with and querying directory service information provided by network operating systems. LDAP is widely used for the overwhelming majority of internal identity services, including Active Directory. Directory services play a key role in many applications by exposing key users, computers, services, and other objects to be queried via LDAP.

LDAP is an application layer protocol that uses port 389 via TCP or UDP. LDAP queries can be transmitted in cleartext and, depending upon configuration, allow some or all data to be queried anonymously. Naturally, LDAP supports authenticated connections and secure communication channels leveraging TLS.

Q12: What Is Network Forensics?

A: Network forensics is the study of data in motion, focusing on gathering evidence via a process supporting admission into court. This means the integrity of the data is paramount, as is the legality of the collection process. Network forensics is closely related to network intrusion detection: the former is legal-focused, and the latter is operations-focused. Network forensics is described as: "Traditionally, computer forensics has focused on file recovery and file system analysis performed against system internals or seized storage devices. However, the hard drive is only a tiny piece of the story. These days, evidence almost always traverses the network and sometimes is never stored on a hard drive.

Q13: What Is The Importance Of Root-Cause Analysis?

A: To effectively manage security incidents, root-cause analysis must be performed. Root-cause analysis attempts to determine the underlying weakness or vulnerability that allowed the incident to be realized. Without successful root-cause analysis, the victim organization could recover systems in a way that still includes the particular weaknesses exploited by the adversary causing the incident. In addition to potentially recovering systems with exploitable flaws, another possibility includes reconstituting systems from backups or snapshots that have already been compromised.

Q14: What Are The Three Metrics Used To Judge Biometric Accuracy?

A: The accuracy of biometric systems should be considered before implementing a biometric control program. Three metrics are used to judge biometric accuracy: the False Reject Rate (FRR), the False Accept Rate (FAR), and the Crossover Error Rate (CER).

False Reject Rate (FRR): A false rejection occurs when the biometric system rejects an authorized subject as unauthorized. False rejections are also called a Type I error. False rejections cause frustration for the authorized users, reduced work due to poor access conditions, and expenditure of resources to revalidate authorized users.

False Accept Rate (FAR): A false acceptance occurs when an unauthorized subject is accepted as valid. Suppose an organization's biometric control is producing a lot of false rejections. In that case, the overall control might lower the system's accuracy by lessening the data it collects when authenticating subjects. When the data points are lowered, the organization risks an increase in the false acceptance rate. The organization risks an unauthorized user gaining access. This type of error is also called a Type II error.

Crossover Error Rate (CER): The Crossover Error Rate (CER) describes the point where the False Reject Rate (FRR) and False Acceptance Rate (FAR) are equal. It is also known as the Equal Error Rate (EER). The CER describes the overall accuracy of a biometric system.

Q15: What Are The Major Biometric Controls?

A: Several biometric controls are used today. Below are the major implementations and their specific pros and cons regarding access control security.

Fingerprints: Fingerprints are the most widely used biometric control available today. Smartcards can carry fingerprint information. Many U.S. Government office buildings rely on fingerprint authentication for physical access to the facility. Examples include intelligent keyboards requiring users to present a fingerprint to unlock the computer's screen saver.

Retina Scan: A retina scan is a laser scan of the capillaries that feed the retina of the back of the eye. This can seem personally intrusive because the light beam must directly enter the pupil, and the user usually needs to press their eye up to a laser scanner eyecup. The laser scan maps the blood vessels of the retina.

Iris Scan: An iris scan is a passive biometric control. A camera takes a picture of the iris (the colored portion of the eye) and then compares photos within the authentication database.

Dynamic Signature: Dynamic signatures measure how someone signs their name. This process is similar to keyboard dynamics, except that this method measures the handwriting of the subjects while they sign their name.

Facial Scan: Facial scan technology has dramatically improved over the last few years. Facial scanning (also called facial recognition) is the process of passively taking a picture of a subject's face and comparing that picture to a list stored in a database.

Q16: What Are Some Disadvantages Of SSO?

A: The disadvantages of SSO are listed below and must be considered before implementing SSO on a system:

• Difficult to retrofit. Retrofitting an SSO solution to existing applications can be difficult, time-consuming, and expensive.

• Unattended desktop. Implementing SSO reduces some security risks but increases others. For example, a malicious user could access a user's resources if the user walks away from his machine and leaves it logged in. Although this is a general security problem, it is worse with SSO because all authorized resources are compromised. At least with multiple logins, the user may only be logged into one system at a time, so only one resource is compromised.

• Single point of attack. With single sign-on, a single, central authentication service is used by all applications. This is an attractive target for hackers who may carry out a denial of service attack.

Q17: What Is Identity As A Service (IDaaS)?

A: With identity being a required pre-condition to manage confidentiality, integrity, and availability effectively, identity plays a crucial role in security. Identity as a Service (IDaaS), or cloud identity, allows organizations to leverage cloud service for identity management. The idea of leveraging public cloud services for identity management can be disconcerting. However, as with all matters of security, there are elements of cloud identity that can increase or decrease risk.

One of the most significant justifications for leveraging IDaaS stems from organizations' continued adoption and integration of cloud-hosted and other public-facing 3rd party applications. Many IDaaS vendors can directly integrate with these services, allowing for more streamlined identity management and single sign-on. Organizations already struggle with internal identity management and, particularly troubling, account/access revocation. These challenges are compounded when organizations must also account for publicly accessible critical applications that the workforce leverages. Other commonly realized security benefits from integration with cloud identity providers include easier deployment and integration of 2-factor or multi-factor authentication, self-service account management and password resets, better support for integrating mobile devices, and centralized audit capabilities.

Q18: What Is Kerberos, And What Are Some Of Its Components?

A: Kerberos is a third-party authentication service that may be used to support Single Sign-On. Kerberos uses symmetric encryption and provides mutual authentication of both clients and servers. It protects against network sniffing and replay attacks. The current version of Kerberos is version 5.

Kerberos has the following components:

• Principal: Client (user) or service

• Realm: A logical Kerberos network

• Ticket: Data that authenticates a principal's identity

• Credentials: a ticket and a service key

• KDC: Key Distribution Center, which authenticates principals

• TGS: Ticket Granting Service

• TGT: Ticket Granting Ticket

• C/S: Client/Server, regarding communications between the two

Q19: What Are The Four Types Of Disk-Based Forensic Data?

A: Here are the four basic types of disk-based forensic data:

Allocated space—portions of a disk partition marked as actively containing data.

Unallocated space—portions of a disk partition that do not contain active data. This includes portions that have never been allocated and previously allocated portions that have been marked unallocated. If a file is deleted, the portions of the disk that held the deleted file are marked as unallocated and made available for use.

Slack space—data is stored in chunks of specific sizes known as clusters (sometimes called sectors or blocks). A cluster is the minimum size that a file system can allocate. If a particular file, or the final portion of a file, does not require the use of the entire cluster, then some extra space will exist within the cluster. This leftover space is known as slack space: it may contain old data or can be used intentionally by attackers to hide information.

"Bad" blocks/clusters/sectors—hard disks routinely end up with sectors that cannot be read due to some physical defect. The sectors marked as bad will be ignored by the operating system since no data can be read in those defective portions. Attackers could intentionally mark sectors or clusters as deficient to hide data within this portion of the disk.

Q20: What Is Application Whitelisting?

A: Application Whitelisting is a more recent addition to endpoint security suites. The primary focus of application whitelisting is to determine in advance which binaries are considered safe to execute on a given system. Once this baseline has been established, any binary attempting to run that is not on the list of known-good binaries is prevented from executing. A weakness of this approach is when a "known good" binary is exploited by an attacker and used maliciously.

Whitelisting techniques include allowing binaries to run that:

• Are signed via a trusted code signing digital certificate

• Match a known good cryptographic hash

• Have a trusted full path and name

Conclusion

JanBask Training's cybersecurity courses can further enhance your knowledge and skills in IAM and other critical areas. These courses offer comprehensive training, practical exercises, and real-world scenarios, preparing you for certifications and making you a strong candidate for cybersecurity roles.