Security+ PBQ 1: IAM and Zero Trust

Scenario

A company is moving to a Zero Trust access model. Employees use a cloud identity provider for SaaS apps, developers need temporary admin access, and HR reports that a former contractor still appears in several groups.

Your task: Select the best IAM or Zero Trust control for each requirement.

Need	Security Goal
Cloud app login	Federated identity
API authorization	Delegated access
Admin elevation	Least privilege

1. Best federation protocol for browser-based SSO to a SaaS application:

2. Best protocol for delegated authorization to an API without sharing the user's password:

3. Assigning permissions based on job function such as HR Analyst or Help Desk Technician is:

4. Granting access based on user role, device health, location, and time of day is:

Access Decisions

5. A push token app on a user's phone is which MFA factor?

6. Developers need admin rights only during an approved maintenance window. Best privileged access control:

7. In Zero Trust, the component that applies the access decision to the connection is the:

8. Best action for a contractor who has left the organization:

Instructor Answer

SAML is commonly used for federated browser-based SSO.
OAuth supports delegated authorization for APIs.
Role-based access control maps permissions to job roles.
Attribute-based access control can evaluate role, location, device posture, and time.
A phone authenticator token is something you have.
Just-in-time permissions reduce standing privilege.
The policy enforcement point applies Zero Trust policy decisions.
Former workers should be de-provisioned promptly.