An organization operates workloads in AWS and Azure. They use AWS IAM Identity Center as the central identity source for AWS accounts and Azure Entra ID for Azure resources. They need to allow a group of developers to access resources in both clouds using a single set of credentials. The security team requires that group membership changes in the HR system take effect within 15 minutes. Which architecture best meets these requirements?

Establish a federation trust between AWS IAM Identity Center and Entra ID using SAML, and configure automatic provisioning of groups from Entra ID to AWS.

Create separate user accounts in both AWS and Azure and rely on the developers to keep their passwords synchronized.

Use AWS IAM Identity Center as the sole identity provider and configure Azure resources to trust it via OIDC federation.

Configure a one-way trust from Entra ID to AWS IAM Identity Center and manually update group memberships in both systems.

A company is architecting a multi-cloud environment with workloads in AWS, Azure, and Google Cloud. They need to provide a unified login experience for their employees across all three clouds. The company's security team requires that all authentication events be logged in a central location. What is the primary challenge they must address?

Using a single cloud provider for all workloads to simplify identity management.

Implementing a custom authentication protocol that works with all three clouds.

Creating separate user accounts in each cloud to avoid conflicts.

Ensuring that each cloud's identity system can trust the same set of credentials and that logs are aggregated.

A company is architecting a cross-cloud identity solution and must comply with the principle of least privilege. They are synchronizing user attributes to both AWS and Azure. Which control should be implemented to ensure least privilege?

Grant permissions based on the user's job title only.

Synchronize all user attributes to both clouds to ensure availability.

Use the same permissions for all users in both clouds to simplify management.

Assign permissions based on the user's role and only include necessary attributes in the synchronization.

A company uses a central identity provider that supports both SAML and OIDC. They are integrating a new application that only supports OIDC. The application needs to access a user's email address and group memberships. Which standard should the architect use to establish trust and exchange these attributes?

Use SAML with the identity provider as the IdP and the application as the Relying Party.

Use SAML with the identity provider as the IdP and the application as the Service Provider.

Use OIDC with the identity provider as the OpenID Provider and the application as the Relying Party.

Use OAuth 2.0 with the identity provider as the authorization server and the application as the resource server.

An organization uses Google Cloud as its primary cloud and is adopting Azure for a new analytics workload. They need to ensure that user attributes such as department and cost center are consistently available in both clouds for access decisions. The source of truth is Google Cloud Identity. What should the organization implement?

Set up a one-way synchronization from Google Cloud Identity to Microsoft Entra ID using a provisioning tool like Entra ID Connect Sync.

Configure a federation trust between Google Cloud and Azure and rely on real-time attribute lookup during each access request.

Use Azure AD Connect to synchronize from Google Cloud Identity to Azure, but only sync the username attribute.

Manually create user accounts in Azure and copy attributes from Google Cloud on a monthly basis.

GIAC Cloud Security Architecture and Design

Domain 1Objective 5

Architecting Cross-Cloud Identity GCAD Practice Questions (Page 1)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 1–5

1expert · hard
An organization operates workloads in AWS and Azure. They use AWS IAM Identity Center as the central identity source for AWS accounts and Azure Entra ID for Azure resources. They need to allow a group of developers to access resources in both clouds using a single set of credentials. The security team requires that group membership changes in the HR system take effect within 15 minutes. Which architecture best meets these requirements?
Select an answer first
2application · medium
A company is architecting a multi-cloud environment with workloads in AWS, Azure, and Google Cloud. They need to provide a unified login experience for their employees across all three clouds. The company's security team requires that all authentication events be logged in a central location. What is the primary challenge they must address?
Select an answer first
3application · medium
A company is architecting a cross-cloud identity solution and must comply with the principle of least privilege. They are synchronizing user attributes to both AWS and Azure. Which control should be implemented to ensure least privilege?
Select an answer first
4application · medium
A company uses a central identity provider that supports both SAML and OIDC. They are integrating a new application that only supports OIDC. The application needs to access a user's email address and group memberships. Which standard should the architect use to establish trust and exchange these attributes?
Select an answer first
5application · medium
An organization uses Google Cloud as its primary cloud and is adopting Azure for a new analytics workload. They need to ensure that user attributes such as department and cost center are consistently available in both clouds for access decisions. The source of truth is Google Cloud Identity. What should the organization implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Architecting Cross-Cloud Identity GCAD Practice Questions (Page 1)

Questions 1–5

A company is architecting a cross-cloud identity solution and must comply with the principle of least privilege. They are synchronizing user attributes to both AWS and Azure. Which control should be implemented to ensure least privilege?

Keep studying — Identity and Access Management