An organization uses a cloud identity provider (IdP) and wants to implement a policy that requires users to re-authenticate every hour when accessing a highly sensitive application. Which control should be configured?

Require MFA for the application.

Use a conditional access policy to block access after 60 minutes.

Set a session timeout policy in the IdP for the application.

Configure the application to log out users after 60 minutes.

An organization uses a cloud identity provider (IdP) and wants to enforce that users can only access a sensitive application from managed devices. The IdP supports conditional access policies. Which policy should the administrator configure?

Block access from unknown locations.

Require MFA for the sensitive application.

Require device compliance for the sensitive application.

Set a session timeout for the application.

An organization uses a cloud identity provider (IdP) to federate with multiple partner companies. Each partner has its own IdP. The organization wants to allow partner users to access a specific application, but only during business hours. Which approach is most appropriate?

Configure the application to check the time of day and deny access outside business hours.

Use conditional access policies in the organization's IdP to restrict access based on time.

Ask each partner to configure their IdP to only issue tokens during business hours.

Create separate accounts for partner users in the organization's IdP and apply time-based policies.

A company is migrating from an on-premises identity system to a cloud identity provider (IdP). The company wants to maintain the ability to use existing on-premises credentials for cloud access. Which approach should they take?

Set up federation between the on-premises identity system and the cloud IdP.

Use a third-party IdP to replace the on-premises system.

Create new cloud-only identities for all users.

Synchronize passwords from the on-premises system to the cloud IdP.

A company uses a cloud identity provider (IdP) to manage identities for its workforce. The company has a high turnover rate and wants to ensure that when an employee leaves, all access is revoked immediately. However, the HR system only updates the IdP once a day. Which approach provides the most immediate revocation?

Configure the IdP to automatically disable accounts when the HR system sends a termination event.

Use a real-time integration between the HR system and the IdP via SCIM.

Use a conditional access policy that checks the HR system's status at each sign-in.

Implement a manual process to disable accounts immediately upon termination.

GIAC Cloud Security Architecture and Design

Domain 1Objective 1

Cloud Identity GCAD Practice Questions (Page 7)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

5concepts

Questions 31–35

31application · medium
An organization uses a cloud identity provider (IdP) and wants to implement a policy that requires users to re-authenticate every hour when accessing a highly sensitive application. Which control should be configured?
Select an answer first
32application · medium
An organization uses a cloud identity provider (IdP) and wants to enforce that users can only access a sensitive application from managed devices. The IdP supports conditional access policies. Which policy should the administrator configure?
Select an answer first
33expert · hard
An organization uses a cloud identity provider (IdP) to federate with multiple partner companies. Each partner has its own IdP. The organization wants to allow partner users to access a specific application, but only during business hours. Which approach is most appropriate?
Select an answer first
34application · medium
A company is migrating from an on-premises identity system to a cloud identity provider (IdP). The company wants to maintain the ability to use existing on-premises credentials for cloud access. Which approach should they take?
Select an answer first
35expert · hard
A company uses a cloud identity provider (IdP) to manage identities for its workforce. The company has a high turnover rate and wants to ensure that when an employee leaves, all access is revoked immediately. However, the HR system only updates the IdP once a day. Which approach provides the most immediate revocation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.