Customer Identity and Access Management GCAD Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A B2B software company provides a customer portal where each customer organization has an admin who manages its users. The company wants to ensure that a customer admin cannot accidentally or maliciously grant themselves access to another customer organization's data. Which authorization design is most appropriate?

   • AScope all roles and permissions to the customer organization's tenant, so an admin's permissions are limited to their own organization.
   • BUse a single global role of 'Customer Admin' that grants access to all customer organizations.
   • CAllow customer admins to create custom roles that can span multiple organizations.
   • DUse the same role definitions as the company's internal workforce IAM.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A mobile app company operating in California must comply with CCPA. The app collects customer location data for personalized recommendations. The product team wants to enable this feature by default. The legal team requires opt-in consent. What is the correct CIAM configuration?

   • APresent a clear consent screen at registration with an unchecked opt-in box, and record the timestamp and version of the consent notice
   • BDo not collect location data at all to avoid consent complexity
   • CEnable location tracking by default and allow customers to opt out in settings
   • DPresent a consent screen at registration with a pre-checked box for location tracking
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A media streaming service wants to allow users to sign in with their existing Google or Facebook accounts. The service also needs to enforce different content access levels based on the user's subscription tier. Which architecture best supports this requirement?

   • AStore the social provider's password in the service's database to authenticate users directly.
   • BFederate with the social providers using OIDC, then issue the service's own session token with subscription claims after checking the user's profile.
   • CCreate a separate account for each social provider the user might use, without linking them.
   • DUse the social provider's token directly as the authorization token for the streaming service's APIs.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is integrating a CIAM platform with a legacy on-premises application that only supports SAML 2.0. The CIAM platform natively supports OIDC and SAML. The application must authenticate customers who log in via social providers (Google, Facebook). The security team requires that the application never sees the customer's social provider credentials. Which integration approach is correct?

   • AConfigure the legacy application to directly federate with Google and Facebook via SAML
   • BConfigure the CIAM platform to act as a SAML identity provider (IdP) for the legacy application, while the CIAM platform itself uses OIDC to federate with social providers
   • CUse a custom adapter to translate OIDC to SAML within the legacy application
   • DHave the legacy application store social provider tokens and use them to call social APIs
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services company notices a spike in account takeover (ATO) attempts against customer accounts. The attacks use previously breached passwords. The CIAM team wants to implement a control that directly addresses this attack vector without requiring customers to change their password immediately. Which control is most effective?

   • ALock all accounts that have not changed their password in the last 90 days
   • BRequire all customers to enable MFA immediately
   • CIncrease the minimum password length to 16 characters for all new passwords
   • DCheck new and existing passwords against a breached-password database (e.g., Have I Been Pwned) and force a password change only when a match is found
   Reveal Solution Discussion Select an answer first