Cloud Identity GCAD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is migrating to a cloud-based identity provider (IdP) and wants to maintain SSO with their on-premises applications that use LDAP. The IdP supports SAML and OIDC, but the on-premises apps only support LDAP. What should the company do to enable SSO for these apps?

   • AConfigure the on-premises apps to use OIDC instead of LDAP.
   • BKeep the on-premises apps on the legacy LDAP directory and do not integrate with the cloud IdP.
   • CReplace the on-premises apps with cloud versions that support SAML.
   • DUse the IdP's federation service to translate SAML/OIDC to LDAP for on-premises apps.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization uses a cloud identity provider (IdP) to manage access to a project management tool. A contractor's contract is ending, and the administrator needs to ensure the contractor can no longer access the tool. Which action should be taken first?

   • ADisable the contractor's account in the IdP.
   • BDelete the contractor's account from the IdP.
   • CRemove the contractor's access from the project management tool.
   • DChange the contractor's password in the IdP.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization uses a cloud identity platform to provision users into Google Workspace and GitHub. When a contractor's contract is extended, the HR system updates the end date. The identity platform is configured to disable the user on the end date. What is the primary benefit of this automated lifecycle management?

   • AIt ensures that the contractor's data is deleted from all systems.
   • BIt eliminates the need for manual user provisioning for new hires.
   • CIt reduces the need for MFA because accounts are disabled automatically.
   • DIt ensures access is removed promptly when the contract ends, reducing the risk of unauthorized access.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization uses a cloud identity provider (IdP) to manage access to multiple SaaS applications. The IT team wants to automate the creation of user accounts in the IdP when new employees are hired, and automatically remove them when they leave. Which approach should they use?

   • AConfigure the IdP to automatically create accounts when users first sign in.
   • BIntegrate the HR system with the IdP using SCIM provisioning.
   • CUse a script that runs nightly to create accounts based on a CSV export from the HR system.
   • DManually create and delete user accounts in the IdP.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses Azure AD as its identity provider and has enabled federation with an on-premises Active Directory. Users access a cloud HR application via SAML SSO. The security team wants to require MFA for all cloud app access, but the on-premises AD does not support MFA. What is the most effective way to enforce MFA?

   • AEnable MFA in the on-premises AD and require it during the federation authentication process.
   • BAsk the HR application vendor to enforce MFA on their side.
   • CDisable federation and use Azure AD as the sole identity source.
   • DConfigure Azure AD conditional access policy to require MFA for the HR application, and enable Azure AD MFA for all users.
   Reveal Solution Discussion Select an answer first