A company uses an external identity provider (IdP) to authenticate users to a cloud application. The application receives a security token from the IdP and trusts it. Recently, the application began rejecting tokens from a group of users who were successfully authenticated by the IdP. What is the most likely cause?

The users' passwords expired, but the IdP still issued tokens.

The IdP's user directory was synchronized with a new on-premises AD.

The application's client ID was changed.

The token signing certificate on the IdP was renewed, and the application still uses the old certificate.

A company uses Okta as its identity provider. Employees authenticate to Okta, which then issues SAML assertions to AWS IAM roles for console access. The company wants to extend this SSO to a new SaaS application that supports SAML 2.0 but not OIDC. The SaaS vendor requires the identity provider to send a specific attribute (employeeID) in the assertion. What should the Okta administrator configure?

Create an OIDC application in Okta and configure the employeeID as a custom claim in the ID token.

Configure the SaaS app to use the same SAML certificate as AWS and rely on the existing assertion.

Add the employeeID attribute to the existing AWS SSO SAML assertion and share that assertion with the SaaS vendor.

Create a new SAML application in Okta, map the employeeID attribute to the SAML assertion, and assign users to the application.

Which security control adds an additional layer of verification beyond a username and password?

Multi-factor authentication (MFA)

Role-based access control (RBAC)

Which protocol is commonly used to implement federated identity and enable single sign-on across cloud and on-premises systems?

Security Assertion Markup Language (SAML)

Hypertext Transfer Protocol (HTTP)

Simple Mail Transfer Protocol (SMTP)

A company uses a cloud identity management platform to provision user accounts in AWS, Azure AD, and Salesforce. When an employee leaves, the HR system triggers deprovisioning. The security team wants to ensure that the employee's access is removed as quickly as possible, but also wants to preserve audit logs. What is the best practice?

Automatically disable the user account in all connected systems and retain the audit logs for the required retention period.

Immediately delete the user account from all systems to ensure no lingering access.

Remove the user from all groups but leave the account active for 30 days.

Disable the account only in the HR system and let other systems sync at their next scheduled run.

GIAC Cloud Security Architecture and Design

Domain 1Objective 1

Cloud Identity GCAD Practice Questions (Page 4)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 16–20

16application · medium
A company uses an external identity provider (IdP) to authenticate users to a cloud application. The application receives a security token from the IdP and trusts it. Recently, the application began rejecting tokens from a group of users who were successfully authenticated by the IdP. What is the most likely cause?
Select an answer first
17application · medium
A company uses Okta as its identity provider. Employees authenticate to Okta, which then issues SAML assertions to AWS IAM roles for console access. The company wants to extend this SSO to a new SaaS application that supports SAML 2.0 but not OIDC. The SaaS vendor requires the identity provider to send a specific attribute (employeeID) in the assertion. What should the Okta administrator configure?
Select an answer first
18foundation · easy
Which security control adds an additional layer of verification beyond a username and password?
Select an answer first
19foundation · easy
Which protocol is commonly used to implement federated identity and enable single sign-on across cloud and on-premises systems?
Select an answer first
20application · medium
A company uses a cloud identity management platform to provision user accounts in AWS, Azure AD, and Salesforce. When an employee leaves, the HR system triggers deprovisioning. The security team wants to ensure that the employee's access is removed as quickly as possible, but also wants to preserve audit logs. What is the best practice?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Cloud Identity GCAD Practice Questions (Page 4)

Questions 16–20

Which security control adds an additional layer of verification beyond a username and password?

Which protocol is commonly used to implement federated identity and enable single sign-on across cloud and on-premises systems?

Keep studying — Identity and Access Management