1.02 Apply Concepts Related to Cloud Identity Access Management Technologies 402 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company is implementing MFA for all administrative users. They want a method that is resistant to phishing and does not require users to carry a separate physical token. Which MFA factor should they choose?

   • ASMS one-time passcodes
   • BAuthenticator app with TOTP
   • CPlatform authenticator (e.g., Windows Hello, Touch ID) using FIDO2
   • DHardware security keys (FIDO2)
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is migrating to a cloud platform and wants to use their existing on-premises Active Directory for authentication. They plan to use federation with SAML 2.0. However, they also have a legacy application that only supports LDAP authentication. What is the best approach to support both SAML-based SSO and the legacy LDAP application?

   • ASet up federation for the cloud apps and expose LDAP to the cloud via a secure VPN or dedicated connection.
   • BCreate separate cloud accounts for the legacy app users and sync passwords from Active Directory.
   • CUse a cloud identity provider that supports both SAML and LDAP, and configure the legacy app to use the IdP's LDAP interface.
   • DReplace the legacy application with a cloud-native version that supports SAML.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company wants to implement a passwordless authentication method for its cloud users. They want to use a method that is based on public-key cryptography and does not require a server to store password hashes. Which authentication method should they choose?

   • ASMS one-time passcodes
   • BCertificate-based authentication with a client certificate
   • CFIDO2 WebAuthn
   • DTOTP authenticator app
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is enforcing MFA for all users. They have a group of service accounts that need to authenticate to a cloud API. The security team is considering whether to require MFA for these service accounts. What is the best practice?

   • ADisable MFA for all users and rely on strong passwords.
   • BDo not require MFA for service accounts; instead, use short-lived credentials and rotate them regularly.
   • CRequire MFA for service accounts using a hardware key attached to the server.
   • DRequire MFA for service accounts using SMS verification.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company uses a cloud platform where users in the finance department need read-only access to billing reports, but only during business hours. The security team wants to enforce this with a single policy that also requires multi-factor authentication for any access from outside the corporate network. Which approach best meets these requirements?

   • ACreate an RBAC role with read-only permissions and attach a policy that includes a condition for time-of-day and a condition requiring MFA for non-corporate IP addresses.
   • BAssign each finance user a service account with read-only permissions and require MFA on the service account.
   • CCreate a custom role with full billing access and rely on the security team to manually disable the role outside business hours.
   • DUse an ABAC policy that grants access based on the user's department attribute, without any time or MFA conditions.
   Reveal Solution Discussion Select an answer first