Architecting Cross-Cloud Identity GCAD Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational company uses a central identity provider and synchronizes user attributes to both AWS and Azure. They must comply with GDPR, which requires that personal data of EU citizens be processed in the EU. The company has offices in the EU and the US. Users in the EU access resources in both AWS and Azure. What is the most important consideration when architecting this cross-cloud identity solution?

   • AEncrypt all user attributes in transit and at rest to ensure GDPR compliance.
   • BAvoid synchronizing user attributes to the US-based cloud regions entirely.
   • CUse a single identity provider located in the EU to avoid any data transfer outside the EU.
   • DEnsure that user attributes synchronized to AWS and Azure are stored in regions that meet GDPR data residency requirements.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When establishing a trust relationship between a cloud service provider (SP) and an external identity provider (IdP), which of the following is typically exchanged to enable the SP to validate assertions from the IdP?

   • AThe SP's internal network topology.
   • BThe IdP's public signing certificate or metadata document.
   • CThe IdP's user password database.
   • DThe SP's private encryption key.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When architecting cross-cloud identity, which security control is essential to protect assertions and tokens exchanged between identity providers and service providers?

   • AUsing the same password for all cloud accounts.
   • BDigital signatures on assertions and tokens, along with encryption of sensitive claims.
   • CDisabling all logging to protect user privacy.
   • DStoring all tokens in a public repository for transparency.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a cross-cloud identity challenge that arises from differences in how cloud providers define and enforce access policies?

   • AEach provider uses a different policy language, such as JSON-based policies in AWS and role-based access control in Azure, making it difficult to apply consistent authorization.
   • BAll cloud providers use the same set of predefined roles, so there is no need for policy mapping.
   • CIdentity policies are automatically synchronized across providers without any configuration.
   • DCloud providers do not allow external identity sources to be used for authentication.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When architecting identity across multiple cloud providers, which of the following is a unique challenge that arises specifically from the use of different cloud providers?

   • AEach cloud provider has its own native identity service with different APIs, policy languages, and trust mechanisms.
   • BIdentity data must be stored in the same geographic region for all clouds.
   • CUsers must remember a separate password for each cloud provider's console.
   • DCloud providers do not support standard identity protocols such as SAML or OIDC.
   Reveal Solution Discussion Select an answer first