Customer Identity and Access Management GCAD Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A B2B company sells software to enterprises. Their customers are organizations, but individual users within those organizations access the software. The company wants to support both SSO via the customer's IdP (SAML) and direct user accounts for smaller customers. The security team requires that access is revoked when a user leaves the customer organization. Which authorization model best meets these requirements?

   • AUse a hybrid model: for SAML users, derive roles from SAML attributes (e.g., group membership) and enforce revocation via the IdP; for direct users, manage roles and revocation in the CIAM platform
   • BUse a single role-based access control (RBAC) model where roles are assigned to individual users, regardless of how they authenticate
   • CRequire all customers to use SAML SSO and disable direct accounts
   • DAssign roles based on the user's email domain and update them manually
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A global e-commerce platform is experiencing a high rate of account takeover (ATO) via credential stuffing. The security team wants to implement phishing-resistant MFA, but the UX team reports that a significant portion of customers use older Android devices without biometric sensors. The company must balance security, UX, and device compatibility. Which MFA approach is the best compromise?

   • AUse a risk-based approach: require FIDO2/WebAuthn passkeys where supported, and fall back to TOTP or SMS OTP for devices without biometric support, with step-up challenges for high-risk transactions
   • BRequire FIDO2 security keys for all customers
   • CUse SMS OTP as the sole MFA method
   • DDeploy TOTP (time-based one-time password) apps for all customers
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is building a customer portal for a B2B product. Each customer organization has many individual users, and the company wants to delegate user management to the customer's own administrators. The company's existing workforce IAM uses a centralized IT team to manage all accounts. What is the most appropriate approach for the customer portal?

   • AHave the company's IT helpdesk create and manage every user account for all customer organizations.
   • BGive every user in a customer organization the same access level regardless of role.
   • CImplement a delegated administration model where each customer organization manages its own users and roles.
   • DUse the company's workforce IAM to authenticate customer users.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A B2B SaaS platform serves both enterprise employees (workforce IAM via SAML) and individual customers (CIAM). A customer who is also an employee of a partner company logs in with their personal account. The platform must ensure this customer cannot access internal admin tools. What is the most appropriate authorization boundary?

   • AAllow the customer to self-select their role during login
   • BUse the same identity provider for both, but assign different roles based on the audience (workforce vs. customer) in the application
   • CMaintain separate identity stores and token issuers for workforce and customer identities, with the application enforcing distinct authorization policies per audience
   • DBlock all access if the email domain matches a known enterprise customer
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which authorization model is commonly used in customer-facing applications to grant access based on the user's role?

   • ARole-Based Access Control (RBAC)
   • BAttribute-Based Access Control (ABAC)
   • CMandatory Access Control (MAC)
   • DDiscretionary Access Control (DAC)
   Reveal Solution Discussion Select an answer first