Free CISSP Identity and Access Management (IAM) Practice Questions (2026)

An application needs to let users log in with their Google account and, upon successful login, retrieve their profile name and email address to pre-fill a form. Do you use OAuth 2.0? Most candidates say yes. They are wrong. The correct answer is OpenID Connect (OIDC). Using OAuth 2.0 alone for identity is a classic CISSP exam trap that tests if you truly understand the difference between authorization and authentication. This is the level of precision you need to pass.

Key facts

Official Body

ISC2 (International Information System Security Certification Consortium)

Exam Format

Computerized Adaptive Testing (CAT)

Number of Questions

125-175 questions

Exam Length

4 hours

Passing Score

700 out of 1000 points

Domain 5 Weighting

13% (approx. 16-23 questions)

According to ISC2's official exam outline, Domain 5 (IAM) accounts for 13% of your total score, making it a critical area to master. (ISC2)

Your 7-Day Sprint to Master CISSP IAM

Domain 5 isn't about memorizing acronyms. It's about judgment. Use this one-week plan to build the mental models required to pass.

Day 1: The Foundation. Forget protocols for a day. Master the principles: Least Privilege, Separation of Duties (SoD), and Need-to-Know. Then, deeply understand the AAA framework: Authentication (proving identity), Authorization (granting permissions), and Accounting (logging actions). Every IAM question maps back to these ideas. Day 2: The Four Models. You must be able to instantly compare the core access control models. Don't just define them; know where to apply them.

Model	Control Basis	Who Manages Permissions?	Best Use Case
MAC	Security labels & clearances	Central administrator / OS	Military, high-security government
DAC	Object owner's discretion	Data owner	File shares, collaborative environments
RBAC	User's job function or role	Central administrator	Most corporate enterprises
ABAC	Policies on subject/object attributes	Central policy engine	Zero Trust, dynamic cloud environments

Day 3: Authentication Deep Dive. Go beyond the three factors (know, have, are). Study biometric accuracy (FAR vs. FRR vs. CER). Understand how password hashes are protected with salting and key stretching (e.g., bcrypt, PBKDF2). Day 4 & 5: Federation Protocols. This is where most candidates lose points. Dedicate two days.

• Day 4: Focus on internal and B2B federation. Diagram the Kerberos flow (AS, TGS, TGT) for internal networks. Then diagram the SAML flow (IdP, SP, Assertion) for cross-domain enterprise SSO.
• Day 5: Focus on web and mobile. Diagram the OAuth 2.0 flow (Resource Owner, Client, Authorization Server, Resource Server) for delegated access. Then, layer OIDC on top to see how it adds the ID Token for identity.

Day 6: The Lifecycle. Map out the identity lifecycle: provisioning, review, and deprovisioning. Research the SCIM (System for Cross-domain Identity Management) protocol and understand its role in automating provisioning between systems like an HR database and cloud apps. Day 7: Test Your Judgment. Now, apply this knowledge. Answer the practice questions below under timed conditions. For every wrong answer, write a one-sentence explanation of the principle you missed. If you need more targeted practice, the VoraPrep CISSP course uses an adaptive engine to drill you on your specific weak spots.

Test Your Judgment: 15 Free CISSP IAM Practice Questions

Answer the following questions. The detailed explanations are below to help you understand the why behind each answer.

Question 1:

A financial services company is implementing a new system for authenticating high-net-worth clients. The CISO wants the highest level of assurance for identity verification. Which of the following represents the strongest form of authentication?

---

Question 2:

An organization uses a discretionary access control (DAC) model for its file servers. A manager in the marketing department creates a sensitive campaign strategy document. By default, who has the authority to grant or deny access to this document?

---

Question 3:

A cloud-native application needs to allow users to log in using their existing social media accounts (e.g., Google) and retrieve their profile name to personalize the user experience. Which technology is specifically designed for this identity verification purpose?

---

Question 4:

During a security audit, you discover that several former employees still have active accounts with access to sensitive project data. This is a critical failure in which phase of the identity lifecycle?

---

Question 5:

A security architect is designing an access control system for a government agency that handles classified information. The system must enforce a strict, top-down security policy where access is granted based on security clearances (e.g., Top Secret, Secret) and formal need-to-know. Which access control model is most appropriate?

---

Question 6:

What is the primary function of the Ticket-Granting Server (TGS) within a Kerberos environment?

---

Question 7:

A user successfully authenticates to their corporate network. They then access the company's internal wiki, CRM, and expense reporting applications without having to enter their credentials again. This is an example of:

---

Question 8:

When evaluating biometric authentication systems, what does the Crossover Error Rate (CER) represent?

---

Question 9:

An application uses SAML for federated identity. When a user tries to access the application (the Service Provider), what is the first step in a Service Provider-initiated authentication flow?

---

Question 10:

A company is moving towards a zero-trust architecture. An architect proposes an access control model that evaluates multiple factors in real-time before granting access. These factors include user role, device security posture, geographic location, and time of day. Which model is being described?

---

Question 11:

A company is rapidly expanding and needs to automate the creation, modification, and deletion of user accounts across multiple cloud applications (SaaS providers) as employees are hired, change roles, or leave the company. Which standard protocol is designed for this purpose?

---

Question 12:

A developer is storing user passwords in a database. To provide the best protection against offline brute-force and rainbow table attacks, which method should be used?

---

Question 13:

A remote user connects to the corporate VPN. The system verifies their identity with a password and a push notification to their phone. Once connected, the system logs the start time, end time, and amount of data transferred for their session. This logging function is part of which component of the AAA framework?

---

Question 14:

In an OAuth 2.0 flow, what is the primary purpose of the 'scope' parameter?

---

Question 15:

A user, Major Smith, has a "Top Secret" clearance. She is trying to access a file labeled "Secret." According to the Bell-LaPadula model's Simple Security Property ("no read up"), is this action permitted?

---

Explanations

1. Correct Answer: D) A client-side digital certificate stored on a hardware token requiring a PIN to unlock.

• Why it's right: This is the strongest option because it is a robust MFA implementation. It combines "something you have" (the hardware token with the certificate's private key) and "something you know" (the PIN). Hardware tokens provide protection against key theft.
• Why C is tempting but less strong: A fingerprint and PIN is also strong MFA. However, a hardware-protected private key (as in option D) is generally considered more resistant to compromise than consumer-grade biometrics. For high-assurance financial transactions, cryptographic proof is superior.
• Why others are wrong: A is single-factor. B uses SMS, which is vulnerable to SIM-swapping and is the weakest form of MFA.

2. Correct Answer: B) The data owner (the manager).

• Why it's right: The defining feature of Discretionary Access Control (DAC) is that the owner of an object (the file) has the discretion to grant or deny access. The person who created the file is its owner.
• Why others are wrong: The system administrator can take control, but the default authority lies with the owner. The security officer sets policy, not file-level permissions. Group membership grants access but not the right to change permissions.

3. Correct Answer: D) OpenID Connect (OIDC)

• Why it's right: OIDC is an identity layer built on top of the OAuth 2.0 framework. While OAuth 2.0 is designed for authorization (granting permission), OIDC is designed for authentication (proving identity). Since the requirement is to log the user in and get their profile info, OIDC is the specific protocol for the job.
• Why C is tempting but wrong: OAuth 2.0 is the foundation, but it only provides an access token that grants permission to an API. It doesn't, by itself, provide standardized identity information about the user. OIDC adds the "ID Token" which contains this information.

4. Correct Answer: D) Deprovisioning

• Why it's right: Deprovisioning is the formal process of removing a user's access rights and accounts upon termination or role change. This failure is a textbook example of a breakdown in this critical process.
• Why C is tempting but wrong: A failed Access Review might have caught this issue, but the root cause of the problem is the failure to deprovision the account in the first place. The CISSP exam requires you to identify the primary failure.

5. Correct Answer: C) Mandatory Access Control (MAC)

• Why it's right: MAC is the only model where access is determined by a central authority based on security labels (on objects) and clearances (on subjects). It is non-discretionary and the standard for military and high-security environments.
• Why others are wrong: DAC allows owner control. RBAC is based on job function, not security classifications. ABAC is more dynamic but MAC is the classic, direct answer for environments based on formal clearance levels.

6. Correct Answer: C) To issue service tickets for specific resources after validating a TGT.

• Why it's right: In Kerberos, the user first authenticates to the Authentication Server (AS) to get a Ticket-Granting Ticket (TGT). They then present this TGT to the Ticket-Granting Server (TGS) to request a service ticket for a specific application (like a file server).
• Why A is tempting but wrong: The Authentication Server (AS) issues the initial TGT, not the TGS. This is a common point of confusion.

7. Correct Answer: C) Single Sign-On (SSO)

• Why it's right: SSO allows a user to authenticate once and gain access to multiple independent software systems without being prompted to log in again. The scenario describes this perfectly.
• Why A is tempting but less precise: Federation is a technology that enables SSO, typically between different organizations. Since this scenario is internal ("corporate network"), SSO is the more direct and accurate term for the user experience.

8. Correct Answer: C) The point where the False Rejection Rate (FRR) and False Acceptance Rate (FAR) are equal.

• Why it's right: The CER (or Equal Error Rate, EER) is the most important single metric for comparing the accuracy of biometric systems. A lower CER indicates a more accurate system overall.
• Why others are wrong: A describes the FRR (Type I error). B describes the FAR (Type II error). The CER is the point where these two error rates cross.

9. Correct Answer: A) The Service Provider sends an authentication request to the Identity Provider.

• Why it's right: In an SP-initiated flow, the user's journey starts at the Service Provider (the application). The SP sees the user is unauthenticated, creates a SAML authentication request, and redirects the user's browser to the Identity Provider with that request.
• Why D is tempting but wrong: The entire purpose of federation is to prevent the user from sending credentials to the Service Provider. The user authenticates only with the trusted Identity Provider.

10. Correct Answer: B) Attribute-Based Access Control (ABAC)

• Why it's right: ABAC is defined by its use of policies that combine attributes of the user, the resource, and the environment (like location, time, or device health). This dynamic, context-aware model is a cornerstone of zero-trust architecture.
• Why A is tempting but less precise: "Rule-Based Access Control" is a generic term. Firewall ACLs are rule-based. ABAC is the specific, modern paradigm that uses a policy engine to evaluate complex combinations of attributes.

11. Correct Answer: B) SCIM (System for Cross-domain Identity Management)

• Why it's right: SCIM is an open standard specifically designed to automate user provisioning. It defines a schema and RESTful API for managing identities, making it easy to sync user data between an identity provider (like an HR system) and service providers (like SaaS apps).
• Why others are wrong: LDAP is for querying directories. SAML is for authentication. RADIUS is for network access control.

12. Correct Answer: C) Hashing the passwords using bcrypt with a unique salt for each user.

• Why it's right: bcrypt is a password-hashing function designed to be slow and computationally expensive, which frustrates brute-force attacks. It automatically incorporates a salt, which defeats rainbow table attacks.
• Why A is tempting but wrong: Using a standard fast hash like SHA-256 without a salt is vulnerable to rainbow tables. Even with a salt, bcrypt is superior because its configurable work factor makes it more resilient to increasing computational power over time.

13. Correct Answer: C) Accounting

• Why it's right: Accounting is the "A" in AAA that answers "what did you do?". It involves collecting usage data like session duration, data transferred, and commands executed. This is used for billing, troubleshooting, and forensics.
• Why others are wrong: Authentication proved who the user was. Authorization granted them access to the VPN. Auditing is the process of reviewing the logs generated by Accounting.

14. Correct Answer: D) To specify the level of access the client application is requesting.

• Why it's right: The 'scope' parameter is fundamental to the principle of least privilege in OAuth 2.0. The client application requests only the permissions it needs (e.g., read_profile, post_tweet). The user then consents to that specific scope of access.
• Why others are wrong: The client_id identifies the application. The token itself has an expiration time. The state parameter is used to prevent CSRF.

15. Correct Answer: B) Yes, because her clearance level is higher than the data's classification level.

• Why it's right: The Simple Security Property of the Bell-LaPadula model states a subject can read an object if the subject's clearance level is greater than or equal to the object's classification level. Since Top Secret > Secret, the read is permitted. This prevents users from reading data above their clearance level.
• Why A is tempting but wrong: The levels do not need to match exactly; the clearance just needs to be at or above the classification.

Analyze Your Score: Your Next Steps

Your score is a diagnostic tool. Use it to guide your next week of study.

• 0-7 Correct: You have foundational gaps in IAM. Focus on Days 1-3 of the sprint plan. Don't move on to federation until you can draw the four access control models from memory and explain the AAA framework to a colleague.
• 8-12 Correct: You understand the concepts but struggle with application. The questions you missed were likely about choosing the best protocol (e.g., OIDC vs. OAuth) or identifying the primary failure. Focus on Days 4-6. For every practice question you miss, force yourself to write one sentence explaining why the correct answer is managerially superior.
• 13-15 Correct: Excellent. You have a strong command of IAM. Your task is to maintain this knowledge and integrate it with other domains. For instance, explore how IAM principles apply in our Free CISSP Security Architecture and Engineering Practice Questions (2026).

No matter your score, consistent, targeted practice is the key. A short quiz is a great start, but passing the CISSP requires building deep knowledge across all eight domains.

Related Resources

• Best CISSP Review Courses (2026): An Honest, Objective Comparison, Compare the best CISSP review courses for 2026.
• Free CISSP Security Architecture and Engineering Practice Questions (2026), Stop memorizing CISSP Domain 3.
• Free CISSP Asset Security Practice Questions (2026), Test your knowledge with these free 2026 CISSP Asset Security (Domain 2) practice questions.
• Free CISSP Security and Risk Management Practice Questions (2026), Get free, expert-written 2026 CISSP Security and Risk Management practice questions.
• CISSP Exam Retake Strategy (2026): How to Pass on Your Next Attempt, Failed the CISSP exam? Get the official 2026 retake policy, waiting periods, and a 3-week plan to analyze your score report.

Official resources and references

• ISC2 CISSP Certification Page: The official source for all exam information.
• ISC2 CISSP Exam Outline: The blueprint for what is covered on the exam.
• NIST Special Publication 800-63: The definitive guide to Digital Identity Guidelines, highly relevant to Domain 5.

Frequently asked questions

How many questions are on the CISSP exam from Domain 5?

Domain 5, Identity and Access Management (IAM), is 13% of the exam. With 125-175 questions on the adaptive test, you should expect between 16 and 23 questions from this domain.

What is the hardest part of CISSP IAM?

Candidates consistently struggle with differentiating the federation protocols. You must know the specific use case for Kerberos (internal), SAML (B2B SSO), OAuth 2.0 (authorization), and OpenID Connect (identity).

Are these CISSP practice questions similar to the real exam?

Yes. They are scenario-based and require you to think like a security manager, choosing the "best" or "most appropriate" answer, which mirrors the real CISSP exam format.

What is the best way to study for CISSP Domain 5?

Use a two-pronged attack. First, use spaced-repetition flashcards for definitions (e.g., MAC vs. DAC, FRR vs. FAR). Second, spend the majority of your time on scenario-based practice questions to build your analytical judgment.

---

Ready to Pass Your CISSP Exam?

Don't leave your certification to chance. VoraPrep is a complete 6-pillar course built to get you certified, with textbook-grade lessons, over 2,200 adaptive practice questions, and a 24/7 personal tutor named Vory. Stop guessing and start targeting your weak areas today.

Visit voraprep.com to get started.

Start Your Free 14-Day Trial at voraprep.com →