Architecting Cross-Cloud Identity GCAD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company has two separate business units that each use a different identity provider (Okta and Microsoft Entra ID). They are consolidating their cloud workloads and want to maintain the existing IdPs while providing a unified access experience for users. What is the recommended approach?

   • AForce all users to migrate to a single IdP to simplify management.
   • BUse a federation broker that connects both IdPs to the cloud workloads, allowing users to choose their IdP.
   • CSynchronize users from both IdPs into a single directory and use that as the only IdP.
   • DCreate separate cloud accounts for each business unit and configure each with its own IdP.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which standard is specifically designed for exchanging authentication and authorization data between an identity provider and a service provider using XML-based assertions?

   • AOAuth 2.0
   • BOpenID Connect (OIDC)
   • CSCIM (System for Cross-domain Identity Management)
   • DSAML (Security Assertion Markup Language)
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company uses a central identity provider and wants to allow users to access resources in both AWS and Azure using the same credentials. They have configured SAML federation with AWS and OIDC federation with Azure. What is the key requirement for establishing trust between the identity provider and each cloud?

   • AEnsure the identity provider uses the same protocol for both AWS and Azure.
   • BCreate user accounts in both AWS and Azure that match the identity provider's users.
   • CConfigure the identity provider as a trusted identity source in both AWS and Azure.
   • DUse the same attribute names in both AWS and Azure policies.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has two identity providers: one for employees and one for customers. They are architecting a cross-cloud identity solution and want to provide employees with access to internal applications in AWS and Azure, while customers access a public-facing application in Azure. The security team wants to minimize the attack surface and ensure that customer identities cannot access internal resources. Which strategy should be recommended?

   • AUse the employee identity provider for customers as well, and create customer accounts in it.
   • BUse separate identity providers for employees and customers, and ensure that the customer identity provider is not trusted by internal applications.
   • CUse the customer identity provider for employees as well, and create employee accounts in it.
   • DUse a single identity provider for both employees and customers, and rely on policies to restrict access.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is migrating workloads from on-premises to both AWS and Azure. They currently use a single on-premises Active Directory. The security team wants to ensure that user access to cloud resources is governed by the same policies as on-premises. Which challenge is most critical to address when architecting cross-cloud identity?

   • ADeciding whether to use a single cloud provider or multiple providers.
   • BEnsuring consistent policy enforcement across AWS IAM and Azure RBAC, which have different policy models.
   • CDetermining the physical location of the identity data to comply with data residency requirements.
   • DChoosing between SAML and OIDC for federation with each cloud provider.
   Reveal Solution Discussion Select an answer first