Poor identity and access management practices

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A whole dev team logs in to the code repository using one shared account called 'devteam'. Why is this poor identity and access management?

A Actions cannot be traced to one person, so accountability is lost

B It makes the repository run slower for every user

2. Which situation shows excessive privileges?

A A tester can only read the test results they need

B A junior tester has admin rights to the production database

3. A developer leaves the company but their account stays active for months. What is the main risk?

A The old account could be misused by the ex-employee or an attacker

B The account will delete itself and corrupt the code

4. Which is the best way to fix the problem of accounts not being removed when staff leave?

A Disable the account as part of the offboarding process

B Wait for the staff member to ask for it to be closed

5. A company lets developers log in to the code repository with only a password. What control is missing?

A A longer file name for the repository

B Multi-factor authentication (MFA)

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1user: shared_dev \| password: Team123		ANo multi-factor authentication, so a stolen password alone gives access to the account
2mfa_enabled = false		BAccess is granted to every staff member instead of only the roles that need it, which is excessive privilege to sensitive code.
3Excessive privileges: a user is given far more access than their job needs		CA shared account used by many developers, so actions cannot be traced to one person and the password is widely known
4Accounts not removed when staff leave stay active and can be misused		Dgrant(intern, role='admin', repo='all')
5allow_access(user='all_staff', repo='payroll_code')		EMany developers share one account, so there is no accountability, and the weak shared password is easy to leak.
6login(user='shared_dev', pass='Team123') # whole team		Fleaver.status = 'active' # left 6 months ago

Definitions

Poor identity and access management

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF passwordOk ___ mfaOk THEN allowLogin

IF user.left THEN ______________(user)

GRANT ______ ON students TO intern;

FOR ____ dev IN team DO createAccount(dev)

if ___ user.mfaOn: requireMfa(user)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A def offboard(staff):

B staff.roles = []

C staff.mfa_devices = []

D staff.active = True

Question 2

A user = login(name, password)

B if user.mfa_ok:

C log('team', 'login')

D show_dashboard(user)

Question 3

A intern = create_user('sam')

B intern.role = 'tester'

C intern.repo_access = 'admin'

Question 4

A require_mfa = False

B def login(user, password):

C if check(user, password):

D return send_code(user)

Question 5

A for staff in left_this_month:

B email_manager(staff)

C remove_from_groups(staff)

Answer Key

Poor identity and access management practices

Section A: Quick Questions

A — Actions cannot be traced to one person, so accountability is lost

B — A junior tester has admin rights to the production database

A — The old account could be misused by the ex-employee or an attacker

A — Disable the account as part of the offboarding process

B — Multi-factor authentication (MFA)

Section B: Match the Pairs

user: shared_dev | password: Team123 → A shared account used by many developers, so actions cannot be traced to one person and the password is widely known

mfa_enabled = false → No multi-factor authentication, so a stolen password alone gives access to the account

Excessive privileges: a user is given far more access than their job needs → grant(intern, role='admin', repo='all')

Accounts not removed when staff leave stay active and can be misused → leaver.status = 'active' # left 6 months ago

allow_access(user='all_staff', repo='payroll_code') → Access is granted to every staff member instead of only the roles that need it, which is excessive privilege to sensitive code.

login(user='shared_dev', pass='Team123') # whole team → Many developers share one account, so there is no accountability, and the weak shared password is easy to leak.

Section C: Definitions

Poor identity and access management — Weak control of accounts, permissions and logins, such as shared accounts or no MFA, so the wrong people or systems can reach code and data.

Section D: Fill in the Blanks

IF passwordOk AND mfaOk THEN allowLogin

IF user.left THEN disableAccount(user)

GRANT SELECT ON students TO intern;

FOR EACH dev IN team DO createAccount(dev)

if not user.mfaOn: requireMfa(user)

Section E: Spot the Error

D — The account stays active after the person has left, which is an account not removed when staff leave. It should be staff.active = False so the account is disabled.

C — Logging every login under a shared 'team' account means the audit trail cannot show who acted. It should log the individual user.id.

C — Giving an intern admin access to the repository is an excessive privilege. Least privilege means a tester only needs 'read' access.

A — Turning multi-factor authentication off means a stolen password alone gives access. It should be require_mfa = True.

B — Emailing a manager does not stop the former staff member logging in. The account must be disabled with disable_account(staff).