Identity & Access Management for AI MCQ 60 Tests With Answers (2026)

Incorrect·A: It is the API or service hosting the protected data that the AI application wants to access

The Resource Server hosts protected resources (e.g., APIs, data). The Authorization Server issues tokens. The Client (AI app) exchanges an auth code for a token from the Auth Server, then uses that token to call the Resource Server.

Incorrect·B: OAuth 2.0 is an authorization framework, whereas OIDC adds an identity layer on top of OAuth to provide authentication (verifying who the user is) via an ID Token

OAuth 2.0 is authorization-only (granting access). OIDC adds authentication (verifying identity) via an additional ID Token containing claims like email, name, etc. OIDC = OAuth 2.0 + identity layer.

Incorrect·C: Three Base64-URL encoded strings separated by dots: Header, Payload, and Signature

JWT format: Header.Payload.Signature (all Base64-URL encoded). The payload contains claims (e.g., sub, aud, exp). The signature verifies the token hasn't been tampered with.

Incorrect·D: By evaluating a complex set of attributes (e.g., user department, time of day, resource sensitivity level) against dynamic policies

ABAC evaluates multiple attributes dynamically. Example: "Allow Data Scientist from Finance department to access Prod DB between 9 AM–5 PM on weekdays from corp IP only." Far more granular than static RBAC.

Incorrect·A: ABAC allows for fine-grained, context-aware decisions (like denying access to an AI model outside of business hours), which static RBAC roles struggle to implement

RBAC is static (e.g., "Developer role has these permissions"). ABAC is dynamic (e.g., "Only if time is business hours AND device is managed AND location is company IP"). Ideal for complex AI governance.

Incorrect·B: If an attacker intercepts an ephemeral token, its brief lifespan (e.g., 15 minutes) severely limits the window of opportunity to exploit it

Ephemeral credentials expire quickly (15 min–1 hour). Even if stolen, they become useless fast. Contrast with static API keys that remain valid indefinitely unless manually rotated.

Incorrect·C: A privileged AI agent is tricked by a malicious user's input into executing a highly authorized action (like querying a secure database) on behalf of that unauthorized user

The confused deputy problem: an attacker tricks a privileged service into performing an action the attacker couldn't do directly. Example: An AI agent with database access is tricked into deleting rows an unauthorized user can't delete themselves.

Incorrect·D: It allows an AI application to temporarily trade its baseline credentials for a set of short-lived, highly specific permissions to perform a critical task, then relinquish them

AssumeRole provides temporary, scoped credentials via STS. An AI app auth as a low-privilege identity, assumes a restricted role for 1 hour to perform a specific task, then credentials expire. Limits blast radius.

Incorrect·A: Authorization Code Grant (often with PKCE)

Authorization Code Grant requires the human user to explicitly consent via a login/approval screen. The app receives an auth code, exchanges it for a token. Ensures user consent, unlike Client Credentials (M2M only).

Incorrect·B: Because there is no human user involved to provide consent via a web browser; the application authenticates itself using its own pre-registered ID and secret

Client Credentials grant: application authenticates directly (client_id + client_secret) without a human in the loop. Perfect for service-to-service auth where no user consent is needed.

Incorrect·C: To obtain a new, short-lived Access Token when the current one expires, without forcing the human user to re-authenticate manually

Access tokens are short-lived (e.g., 15 min). When they expire, the app presents a long-lived refresh token to the auth server to get a new access token silently, without bugging the user to log in again.

Incorrect·D: Creating highly granular, secure zones within a network to isolate workloads (like a specific AI model) and restrict lateral movement if a breach occurs

Micro-segmentation: divide the network into tiny, heavily controlled zones. Each zone has strict firewall rules. Even if an attacker breaches zone A, they can't freely move to zone B without additional auth/authorization.

Incorrect·A: By dynamically granting elevated privileges to an administrator for a strictly limited duration only when they actively need it, rather than leaving standing privileges open 24/7

JIT provisioning grants admin rights temporarily (e.g., 2 hours) only when requested. After expiry, rights disappear automatically. Dramatically reduces the window of exposure if the admin account is compromised.

Incorrect·B: By cryptographically verifying the Signature section of the JWT using a shared secret or a public key

JWT Signature: the issuer signs the header.payload using a secret (HS256) or private key (RS256). The API verifies the signature using the shared secret or public key. If the payload is modified, the signature becomes invalid.

Incorrect·C: Exchanging authentication and authorization data between an Identity Provider and a Service Provider to enable cross-domain Single Sign-On (SSO)

SAML: an XML-based federation standard. User authenticates at their company's IdP, which issues a SAML assertion. The assertion is presented to a third-party app (service provider) for SSO.

Incorrect·D: The vector database must perfectly map the original source document's access control lists (ACLs) to the semantic chunks, ensuring the AI agent only retrieves context the end-user is actually authorized to see

RAG IAM challenge: documents are chunked and vectorized. If a user shouldn't see document X, the AI must not retrieve *any* chunk from X. Requires careful ACL mapping from original docs to embeddings.

Incorrect·A: The intended recipient or target API that the token is meant for, preventing a token issued for one AI service from being maliciously used on another

JWT claim `aud` specifies the intended audience (e.g., "api.example.com"). If a token is stolen and misused on a different API, that API should reject it because the `aud` claim doesn't match.

Incorrect·B: An automatically managed identity that an application (like an AI service) can use to connect to resources, eliminating the need for developers to manage credentials

Managed Identity: Azure/cloud automatically creates and rotates credentials for an app. The app doesn't manage keys; the cloud provider does. Reduces credential sprawl and the risk of hardcoded secrets.

Incorrect·C: An entity (such as a user, group, or service account) that can request to perform an action on a resource

Principal: any entity that can be granted permissions. Users, groups, services, roles—all are principals. IAM policies grant principals permissions (Allow/Deny statements).

Incorrect·D: It permits a user or service to grant an existing IAM Role to an AI service (like SageMaker or EC2), effectively defining what permissions that service will assume when it executes

PassRole allows a service to assume a role. Example: developer has PassRole permission for "DataScientistRole". They launch an EC2 instance with that role, and the instance inherits all of DataScientistRole's permissions.

Incorrect·D: It allows Service A to trade the original user's token for a new, scoped token explicitly minted for calling Service B, maintaining an auditable chain of delegation

Token Exchange: Service A receives a user token, calls an STS (Security Token Service) to exchange it for a token that Service B trusts and that carries the original user's identity. Maintains delegation chain.

Incorrect·A: It requires both the client (the AI service) and the server to present valid X.509 certificates to cryptographically prove their identities to each other during the TLS handshake

mTLS (mutual TLS): standard TLS authenticates server only (server cert). mTLS authenticates both: client presents cert, server presents cert. Both verify each other's X.509 cert. Gold standard for backend security.

Incorrect·B: If the agent acts exactly as the user, it bypasses the "Confused Deputy" problem but makes it impossible via standard audit logs to distinguish between actions taken directly by the human and autonomous actions taken by the agent on their behalf

Delegation challenge: if agent truly impersonates the user, audit logs show the user performed the action (non-repudiation lost). Best practice: agent acts as agent (own identity) but with delegated permissions, maintaining audit trail.

Incorrect·C: The system continuously evaluates contextual risk factors (e.g., sudden behavioral changes, rapid data extraction) and can dynamically revoke or step-up authentication requirements mid-session

CARTA: continuous assessment, not one-time login. If risk increases (e.g., unusual API calls, giga-byte extraction), session is challenged or revoked. Adapts dynamically to threats.

Incorrect·D: To act as a unified, decoupled policy engine that evaluates policies written in Rego to make fine-grained authorization decisions across the entire microservice stack

OPA: a policy-as-code engine. Define authorization rules in Rego, OPA evaluates them across Kubernetes, APIs, databases. Single source of truth for all access decisions.

Incorrect·A: An Explicit Deny universally overrides any and all Allow statements, guaranteeing that the action is blocked regardless of other assigned permissions

AWS IAM evaluation: default Deny. If ANY policy has Explicit Deny, access is Denied (Deny always wins). Use Explicit Deny to permanently block sensitive actions, e.g., preventing developers from deleting backups.

Incorrect·B: It fetches the Identity Provider's public keys from the JWKS endpoint and uses the corresponding public key to verify the cryptographic signature generated by the IdP's private key

JWKS (JSON Web Key Set): IdP publishes public keys at a JWKS endpoint. API fetches the correct public key (matching the JWT's `kid` header), uses it to verify the signature. Enables rotation without app redeployment.

Incorrect·C: They embed specific tenant IDs, roles, and context directly into the token's claims, allowing the application to enforce strict data isolation without constantly querying a centralized database

Claims-based: tenant ID embedded in JWT claim. API checks claim to determine which tenant's data the user can access. Scales better than constant DB lookups; no shared state.

Incorrect·D: An attacker can modify the token payload, set the algorithm header to 'none', and strip the signature, potentially tricking a vulnerable API into accepting the forged token as valid

JWT algorithm: "none" means no signature. Vulnerable APIs that don't validate the algorithm field accept unsigned tokens. Attacker sets alg="none", modifies payload. Always validate: alg is expected AND signature is valid.

Incorrect·A: It prevents Authorization Code interception attacks (especially in public or mobile clients) by tying the authorization request to a cryptographically hashed challenge/verifier generated dynamically by the client

PKCE (RFC 7636): client generates a random code_verifier, hashes it (code_challenge), includes in auth request. Auth server validates the hash when client exchanges auth code. Prevents auth code theft.

Incorrect·B: Providing a standardized way to issue short-lived, cryptographically verifiable identities (SVIDs) to workloads/microservices to facilitate secure mTLS communication

SPIFFE: standard for workload identity in Kubernetes. SPIRE (SPIFFE Runtime Environment) issues SVIDs (certificates) to pods. Enables automatic mTLS between microservices without manual cert management.

Incorrect·C: Macaroons support delegation with attenuation; a bearer can append specific, restrictive caveats to the token before passing it to a third party, securely narrowing its permissions without contacting the central issuer

Macaroons: bearer can add restrictive caveats (e.g., "valid only until 5 PM", "only for this IP"). Caveats are cryptographically signed. Enables decentralized delegation without issuer involvement.

Incorrect·D: It complements IAM by dynamically obfuscating or redacting sensitive columns (like SSNs) in the query result set based on the specific authorization role of the requesting identity

Data masking (e.g., showing "***-**-1234" instead of full SSN) is a defense-in-depth layer. Even if IAM grants access to a column, masking redacts sensitive bits based on role. Complements, doesn't replace, IAM.

Incorrect·A: It represents a unique, immutable identifier for the authenticated user within the issuer's system, acting as the primary key for identity federation

JWT/OIDC claim `sub` (subject): unique user ID. `sub` + `iss` (issuer) together uniquely identify a user across security domains. Primary key for federation.

Incorrect·B: By evaluating dynamic signals—such as requiring the developer to originate from a corporate IP, use a managed device, and connect during business hours—before allowing access to the data bucket

Context-aware policies: grant access only if multiple conditions are met (corp IP, managed device, business hours, etc.). Prevents attackers/insiders from exfiltrating data from unusual contexts.

Incorrect·C: An attacker exploiting a misconfigured IAM policy (e.g., the ability to create a new policy version) to grant themselves higher permissions, effectively gaining administrator access

IAM privilege escalation: attacker finds a misconfiguration (e.g., can create policies, can assume high-privilege roles) and exploits it to escalate from user → admin. Regular IAM audits catch these.

Incorrect·D: The PDP evaluates the rules and makes the "Allow/Deny" decision, whereas the PEP sits in the traffic path to intercept the request and enforce the PDP's decision

PDP/PEP separation: PDP is centralized policy engine (OPA, etc.), makes decisions. PEP is distributed enforcer (proxy, firewall, sidecar), intercepts traffic and enforces PDP decisions.

Incorrect·A: By verifying user identity, device context, and access policies at the application layer before proxying the web request to the internal AI application

IAP (e.g., Google BeyondCorp): proxy sits in front of internal app, verifies identity and context, then proxies auth'd requests to the app. No VPN needed; zero trust access.

Incorrect·B: The sidecar proxy extracts the JWT, cryptographically validates the signature via the mesh's control plane, and evaluates embedded claims or local OPA policies before allowing the request through

Service mesh (Istio): sidecars validate JWTs, enforce mTLS cert validation, check OPA policies. All request-level auth happens in the mesh, decoupling from app code.

Incorrect·C: In modern cloud environments, IPs are highly dynamic and easily spoofed or shared among multiple tenants, completely failing to establish the true *identity* or *context* of the caller

IP allowlisting alone is weak: IPs are shared (VPN, cloud, NAT), spoofable, and dynamic. Modern security requires identity-based authorization (certs, tokens, etc.), not just IP.