Home / Flashcard library / Careers & certifications / ISC2 CISSP / Identity and Access, Security Assessment

Careers & certifications

CISSP — Identity and Access, Security Assessment flashcards

10 of 76 cards free to study here · 2 topics · the whole deck is built into Willys

CISSP domains 5 and 6: authentication factors and biometric errors, Kerberos, SAML, OAuth and OIDC roles, access control models, identity lifecycle and privilege creep, test planning and rules of engagement, box testing, SAST, DAST and fuzzing, log review, KPIs and SOC reports.

Get the app All ISC2 CISSP decks

Learn deck · part of ISC2 CISSP · written against: CISSP exam outline (domains effective April 2024). Updated 2026-10-10.

Study the free sample

10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 10 sample cards as a list
  1. What are the three classic authentication factor types, and which attributes are often added to them?
    Type 1 — something you know, Type 2 — something you have, Type 3 — something you are. Location (somewhere you are) and behaviour (something you do) are often added as context.
    Identity and Access Management › Authentication
  2. A login uses a password plus a one-time code sent by SMS. How many factor types is that, and why does NIST SP 800-63B treat SMS codes as restricted?
    Two — something you know and something you have (the phone). SMS is restricted because codes can be intercepted or diverted through SIM swapping and phone-network attacks, so stronger authenticators are preferred.
    Identity and Access Management › Authentication
  3. In biometrics, which error is Type I and which is Type II?
    Type I is the false rejection rate (FRR) — a legitimate user is refused. Type II is the false acceptance rate (FAR) — an impostor is let in, the more dangerous error.
    Identity and Access Management › Authentication
  4. What is the crossover error rate (CER), and how is it used?
    The point where FAR and FRR are equal when sensitivity is tuned. A lower CER means a more accurate biometric system, so it is used to compare products.
    Identity and Access Management › Authentication
  5. A vault's fingerprint reader is made more sensitive. What happens to FAR and FRR, and is that acceptable here?
    FAR falls and FRR rises — fewer impostors get in, but more legitimate users are refused. In a high-security area that trade is usually acceptable.
    Identity and Access Management › Authentication
  6. What must be in place BEFORE a penetration test begins?
    Written authorization from senior management with an agreed scope and rules of engagement. Without it, the test may be illegal.
    Security Assessment and Testing › Assessment Strategy
  7. What belongs in a penetration test's rules of engagement?
    Systems in and out of scope, timing windows, permitted techniques, emergency contacts, handling of any sensitive data found, and conditions for stopping the test.
    Security Assessment and Testing › Assessment Strategy
  8. Internal, external or third-party audit — which offers the greatest independence?
    A third-party audit by an independent firm, often required by regulators or customers. Internal audit is useful but reports within the organisation it examines.
    Security Assessment and Testing › Assessment Strategy
  9. To whom should the internal audit function report, and why?
    To the board's audit committee, so its findings cannot be suppressed by the managers whose areas it audits.
    Security Assessment and Testing › Assessment Strategy
  10. Midway through a test, the testers find a critical flaw that is already being exploited in production. What should they do FIRST?
    Stop and notify the designated contact immediately, as the rules of engagement should require, rather than holding it for the final report.
    Security Assessment and Testing › Assessment Strategy

Unlock the whole deck

You are studying a free 10-card sample. All 76 cards of CISSP — Identity and Access, Security Assessment, the other 5 ISC2 CISSP decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More ISC2 CISSP decks

Security and Risk Management, Asset SecurityArchitecture, Engineering and Network SecuritySecurity Operations and Software Development SecurityPractice Questions, Part 1Practice Questions, Part 2

← All ISC2 CISSP decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

  • ISC2 CISSP exam outline (domains effective April 2024) — topic outline only; no text copied
  • Checked against NIST SP 800-63B-4 and SP 800-63A-4 (2025), SP 800-115 (2008), SP 800-162 (2014), SP 800-92 (2006) and SP 800-126 Rev. 3 (SCAP 1.3, 2018) — U.S. government publications; reference only, no text copied
  • Checked against IETF RFC 4120 (Kerberos V5), RFC 6749 (OAuth 2.0) and RFC 7643/7644 (SCIM 2.0); OASIS SAML 2.0 Core and Profiles; OpenID Connect Core 1.0; AICPA & CIMA descriptions of SOC 1, SOC 2 and SOC 3 reports — reference only; no text copied

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CISSP® is a registered mark of ISC2, Inc. This product is not affiliated with or endorsed by ISC2.

Use of these pages is covered by our Terms of Use.