CISSP Practice Test

CISSP practice test: what's covered

• Identity & Access Management

Free CISSP sample questions

1. During an architecture review, a security manager maps the IAM control flow and needs to label the AAA framework correctly. Which expansion of AAA is accurate?

   • A. Authentication, Authorization, and Accounting (Accountability)
   • B. Access, Approval, and Audit logging
   • C. Allocation, Assignment, and Assurance review
   • D. Asset tracking, Authority, and Action control
   Show answer

   Correct: A. AAA stands for Authentication (verifying identity), Authorization (granting permitted actions), and Accounting (recording activity). The other choices are incorrect because Access/Approval/Audit, Allocation/Assignment/Assurance, and Asset/Authority/Action are invented expansions that do not match the recognized standard used in RADIUS, TACACS+, and Diameter access frameworks.

2. A CISSP candidate is asked how the IAAA model differs from the AAA model when describing the full access control sequence. What does IAAA add?

   • A. An inspection step performed after accounting
   • B. Identification placed at the very start of the sequence
   • C. An integrity check applied to every transaction
   • D. An insurance review of residual access risk
   Show answer

   Correct: B. IAAA expands AAA to Identification, Authentication, Authorization, and Accounting, prepending the act of claiming an identity. Inspection, integrity, and insurance are incorrect because they are not the leading element of the model and do not represent the claim-then-verify sequence that underpins logical access control.

3. A new analyst enters a username at a login portal before any password prompt appears. In access control terms, this single action is best classified as which step?

   • A. Authentication of the supplied secret
   • B. Authorization of the requested resources
   • C. Identification, the act of claiming an identity
   • D. Accounting of the session activity
   Show answer

   Correct: C. Providing a username is identification because the subject is merely asserting who they are. It is not authentication, which verifies that claim with a factor; not authorization, which grants resource access after verification; and not accounting, which logs activity, so those options are incorrect.

4. After a user enters their username and a hardware token code, the system confirms the credential is valid. Which access control function has just completed?

   • A. Recording the event into the audit trail
   • B. Granting permission to specific resources
   • C. Encrypting the session transport channel
   • D. Verifying the claimed identity using one or more factors
   Show answer

   Correct: D. Authentication confirms that the subject is who they claimed by validating presented factors. Audit recording is accounting, granting permission is authorization, and encryption protects transport but does not establish identity, so those options are incorrect for the function that just completed.

5. A security manager separates the distinct AAA functions when reviewing an authenticated employee opening a payroll file. Which statements correctly map the access control functions involved? (Choose TWO)

   • A. Authorization grants or denies specific actions on resources after authentication
   • B. Identification is the act of claiming an identity such as a username
   • C. Accounting is what verifies the supplied authentication factors
   • D. Authentication is what writes the access attempt into audit logs
   • E. Authorization is the same activity as the initial identity claim
   Show answer

   Correct: A and B. Authorization decides permitted actions after authentication, and identification is the initial claim of identity. Saying accounting verifies factors, authentication writes logs, or authorization equals the identity claim is incorrect because verification is authentication, logging is accounting, and authorization is distinct from identification.

Last updated: 2026-10-19

CISSP practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CC practice test
• ISC2 CCSP practice test
• ISC2 CGRC practice test
• ISC2 SSCP practice test