What is the purpose of deprovisioning in identity lifecycle management?

To remove or disable a user's access rights when they leave the organization or no longer need access.

To reset a user's password when they forget it.

To assign additional permissions to a user as their role expands.

To create new user accounts for employees when they join the organization.

A company has a hybrid identity environment with on-premises Active Directory and Azure AD. They use Azure AD Connect to sync users. They want to enable SSO for a cloud app that supports SAML, but they also want to enforce MFA for all cloud app access. The on-premises AD does not support MFA. What is the best approach?

Disable federation and use Azure AD as the sole identity source.

Ask the cloud app vendor to enforce MFA on their side.

Implement MFA in the on-premises AD and require it during the federation process.

Use Azure AD conditional access to require MFA for the cloud app, while keeping the federation with on-premises AD.

A company uses a cloud identity provider (IdP) to federate with a partner organization. The partner uses a different IdP. The company wants to ensure that only users from the partner's HR department can access a specific application. Which approach is most appropriate?

Create separate accounts for HR users in the company's IdP.

Configure the application to trust all users from the partner's IdP.

Use a conditional access policy that checks the user's department attribute.

Ask the partner to include a group claim in the SAML assertion and configure the application to check for the HR group.

What is the purpose of conditional access policies in cloud identity security?

To encrypt all data stored in the cloud automatically.

To create new user accounts for external partners.

To enforce access decisions based on signals such as user location, device compliance, and risk level.

To provide a backup of user credentials in case of loss.

A company wants to allow its employees to use their existing corporate credentials to access a third-party SaaS application. The company uses an on-premises Active Directory and does not want to maintain separate accounts in the SaaS application. Which technology should they implement?

Direct LDAP authentication from the SaaS application to the on-premises AD.

Password synchronization between the SaaS application and the on-premises AD.

OAuth 2.0 authorization code flow with the SaaS application as the resource server.

Federated identity using SAML 2.0 between the corporate IdP and the SaaS application.

GIAC Cloud Security Architecture and Design

Domain 1Objective 1

Cloud Identity GCAD Practice Questions (Page 6)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 26–30

26foundation · easy
What is the purpose of deprovisioning in identity lifecycle management?
Select an answer first
27expert · hard
A company has a hybrid identity environment with on-premises Active Directory and Azure AD. They use Azure AD Connect to sync users. They want to enable SSO for a cloud app that supports SAML, but they also want to enforce MFA for all cloud app access. The on-premises AD does not support MFA. What is the best approach?
Select an answer first
28expert · hard
A company uses a cloud identity provider (IdP) to federate with a partner organization. The partner uses a different IdP. The company wants to ensure that only users from the partner's HR department can access a specific application. Which approach is most appropriate?
Select an answer first
29foundation · easy
What is the purpose of conditional access policies in cloud identity security?
Select an answer first
30application · medium
A company wants to allow its employees to use their existing corporate credentials to access a third-party SaaS application. The company uses an on-premises Active Directory and does not want to maintain separate accounts in the SaaS application. Which technology should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.