Which standard is built on top of OAuth 2.0 and provides a standardized way for clients to verify the identity of an end user based on the authentication performed by an authorization server?

LDAP (Lightweight Directory Access Protocol)

A company uses AWS as its primary cloud and is adopting Google Cloud for a new project. They want to allow AWS IAM roles to access Google Cloud resources using federated identity. The company requires that the trust relationship be established without creating new user accounts in Google Cloud. What should they configure?

Export AWS IAM users to Google Cloud using a CSV file and import them as Google Cloud users.

Create a Google Cloud service account for each AWS IAM role and share the private keys with AWS.

Use a VPN to connect the two clouds and rely on network-level access control.

Set up a SAML or OIDC federation between AWS IAM and Google Cloud, mapping AWS roles to Google Cloud service accounts.

Why is policy mapping necessary when architecting cross-cloud identity?

Because users need separate passwords for each cloud.

Because cloud providers require the same policy format for all clouds.

Because each cloud provider has a different policy language and authorization model, so the same logical access rule must be expressed differently in each cloud.

Because cloud providers do not support any form of access control.

A company has a workload in AWS that needs to access resources in Azure. They want to use a service principal in Azure to authenticate the AWS workload. The company requires that the trust be established using a standard protocol. What should they configure?

Set up an OIDC federation between AWS IAM and Azure AD, allowing the AWS workload to assume an Azure service principal.

Use a VPN to connect the clouds and rely on network-level authentication.

Create a shared secret and embed it in the AWS workload to authenticate to Azure.

Export the AWS IAM role's credentials and import them into Azure as a service principal.

A company operates in a regulated industry and uses AWS and Azure. They have a central identity team that manages Microsoft Entra ID, but a subsidiary uses Okta. The company must ensure that all access decisions are consistent and auditable across both clouds. They are considering a single federation broker. What is the most significant challenge they must address?

Reconciling different attribute schemas and policy mappings between Entra ID, Okta, AWS, and Azure.

Convincing the subsidiary to migrate from Okta to Entra ID.

Choosing a broker that supports both SAML and OIDC protocols.

Ensuring the federation broker has sufficient network bandwidth to handle all authentication requests.

GIAC Cloud Security Architecture and Design

Domain 1Objective 5

Architecting Cross-Cloud Identity GCAD Practice Questions (Page 3)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 11–15

11foundation · easy
Which standard is built on top of OAuth 2.0 and provides a standardized way for clients to verify the identity of an end user based on the authentication performed by an authorization server?
Select an answer first
12application · medium
A company uses AWS as its primary cloud and is adopting Google Cloud for a new project. They want to allow AWS IAM roles to access Google Cloud resources using federated identity. The company requires that the trust relationship be established without creating new user accounts in Google Cloud. What should they configure?
Select an answer first
13foundation · easy
Why is policy mapping necessary when architecting cross-cloud identity?
Select an answer first
14application · medium
A company has a workload in AWS that needs to access resources in Azure. They want to use a service principal in Azure to authenticate the AWS workload. The company requires that the trust be established using a standard protocol. What should they configure?
Select an answer first
15expert · hard
A company operates in a regulated industry and uses AWS and Azure. They have a central identity team that manages Microsoft Entra ID, but a subsidiary uses Okta. The company must ensure that all access decisions are consistent and auditable across both clouds. They are considering a single federation broker. What is the most significant challenge they must address?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Architecting Cross-Cloud Identity GCAD Practice Questions (Page 3)

Questions 11–15

Which standard is built on top of OAuth 2.0 and provides a standardized way for clients to verify the identity of an end user based on the authentication performed by an authorization server?

Why is policy mapping necessary when architecting cross-cloud identity?

A company has a workload in AWS that needs to access resources in Azure. They want to use a service principal in Azure to authenticate the AWS workload. The company requires that the trust be established using a standard protocol. What should they configure?

Keep studying — Identity and Access Management