Cloud Identity GCAD Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company uses a cloud identity provider (IdP) to federate with a partner organization. The partner's IdP issues SAML assertions that include the user's email address. The company's application needs to identify users by a unique identifier. Which claim should the application use?

   • AThe email address claim, which is unique to each user.
   • BThe user's IP address.
   • CThe user's first and last name.
   • DThe NameID claim, which is a persistent identifier for the user.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company uses a cloud identity provider (IdP) to authenticate users to a critical application. The security team wants to require multi-factor authentication (MFA) for all users, but the CEO wants to minimize friction for the sales team. Which approach balances security and usability?

   • AUse a single MFA method for all users, such as SMS.
   • BDisable MFA for the sales team and require it for all other users.
   • CRequire MFA only for users with administrative roles.
   • DRequire MFA for all users, but allow trusted locations to skip MFA.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company uses a cloud identity provider (IdP) to authenticate users to AWS and Azure. The security team wants to enforce MFA for all cloud console access, but also wants to avoid prompting users for MFA on every session. They want to balance security and user experience. What is the best approach?

   • ADisable MFA for users on the corporate network.
   • BRequire MFA for every authentication request without any session persistence.
   • CUse a hardware token for all users and require it for every session.
   • DConfigure conditional access policies to require MFA for cloud consoles, but allow session persistence for a set period.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary function of an identity provider (IdP) in a cloud environment?

   • ATo authenticate users and issue assertions or tokens that confirm their identity to other systems.
   • BTo provide a firewall that filters traffic between users and cloud applications.
   • CTo store encrypted passwords for all users in a single database.
   • DTo assign permissions to users based on their role in the organization.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization uses a cloud identity provider (IdP) for all employee access to SaaS applications. When an employee leaves the company, the HR system automatically triggers the deprovisioning process. However, the administrator notices that the user's access to some applications persists for several hours after termination. What is the most likely cause?

   • AThe user's password was not reset immediately after termination.
   • BThe IdP does not support automated deprovisioning.
   • CThe deprovisioning process only disables the account in the IdP, but application sessions remain valid until the token expires.
   • DThe HR system failed to send the termination event to the IdP.
   Reveal Solution Discussion Select an answer first