Which protocol is specifically designed for automating the exchange of user identity information between systems, such as synchronizing user accounts from an on-premises directory to a cloud identity provider?

SCIM (System for Cross-domain Identity Management)

What is the primary purpose of directory synchronization in a cross-cloud identity architecture?

To store user passwords in a central location for all clouds.

To replace the need for authentication protocols like SAML and OIDC.

To create a single sign-on experience without any federation.

To ensure that user identities and attributes are consistent across multiple cloud directories.

Which compliance consideration is particularly relevant when architecting cross-cloud identity for an organization that operates in multiple countries?

Ensuring that no logs are kept of authentication events.

Ensuring that all identity data is stored in the same cloud provider.

Ensuring that identity data transfers between clouds comply with data protection regulations such as GDPR.

Ensuring that all users use the same password.

What is the purpose of attribute mapping in a cross-cloud identity architecture?

To store user attributes in a central database.

To encrypt user attributes during transmission.

To translate user attributes from an identity provider into the format expected by each cloud provider's authorization system.

To eliminate the need for access policies in each cloud.

A company has an on-premises Active Directory and uses AWS for a new application. They want employees to authenticate using their existing AD credentials without needing to re-enter passwords. The application is hosted in AWS and supports SAML. What should the company implement?

Use a VPN to connect the on-premises network to AWS and allow direct AD authentication.

Set up a SAML federation between Active Directory Federation Services (AD FS) and AWS IAM.

Install AD on an EC2 instance and join the application to that domain.

Create IAM users in AWS with the same passwords as AD.

GIAC Cloud Security Architecture and Design

Domain 1Objective 5

Architecting Cross-Cloud Identity GCAD Practice Questions (Page 6)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 26–30

26foundation · easy
Which protocol is specifically designed for automating the exchange of user identity information between systems, such as synchronizing user accounts from an on-premises directory to a cloud identity provider?
Select an answer first
27foundation · easy
What is the primary purpose of directory synchronization in a cross-cloud identity architecture?
Select an answer first
28foundation · easy
Which compliance consideration is particularly relevant when architecting cross-cloud identity for an organization that operates in multiple countries?
Select an answer first
29foundation · easy
What is the purpose of attribute mapping in a cross-cloud identity architecture?
Select an answer first
30application · medium
A company has an on-premises Active Directory and uses AWS for a new application. They want employees to authenticate using their existing AD credentials without needing to re-enter passwords. The application is hosted in AWS and supports SAML. What should the company implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.