Edge Identity and Authentication GCSA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company manages a fleet of edge devices that need to access a cloud API using API keys. The keys are currently stored in a configuration file on each device. The security team wants to reduce the risk of key exposure and implement automatic rotation. Which approach is the most secure and operationally efficient?

   • AIntegrate with a secrets management service that distributes keys to devices and supports scheduled rotation.
   • BUse the same API key for all devices and rotate it manually every quarter.
   • CEncrypt the configuration file with a key derived from the device's serial number.
   • DStore the keys in a public cloud object store with restricted access.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A multinational corporation has offices in several countries, each with its own Active Directory forest. Employees travel between offices and need to access edge applications in each location without repeated logins. The security team wants to use identity federation to enable single sign-on across these forests. Which technology should they implement?

   • AUse a VPN to connect all offices and join all computers to a single domain.
   • BSynchronize all user passwords to a single cloud identity provider.
   • CSet up Active Directory Federation Services (AD FS) with a federation trust between each forest's AD FS server.
   • DCreate a one-way trust between the forests at the Windows Server level.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A manufacturing company operates edge gateways in multiple plants. Each plant uses a different identity provider (IdP) for its local operators. The company wants operators to sign in once at any plant and have their permissions enforced by the edge gateways based on group membership from their home IdP. The gateways are in a separate network domain from the corporate IdPs. Which solution should the security architect choose?

   • AFederate each plant's IdP with a central identity broker that issues short-lived tokens to the edge gateways.
   • BConfigure each gateway to accept any certificate issued by the corporate root CA as proof of identity.
   • CUse a VPN that places all gateways in the corporate Active Directory domain.
   • DCreate local user accounts on each gateway and synchronize passwords nightly from the corporate directory.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A financial services firm uses edge devices that authenticate to a central API using OAuth 2.0 tokens obtained from an identity provider. The firm wants to implement zero trust by continuously verifying the device's security posture before granting access to sensitive data. Which approach best achieves this while minimizing latency for legitimate requests?

   • APerform a full device posture scan on every API request.
   • BRequire the device to present a token that includes a claim about its posture, and have the API validate the token signature and check the posture claim on every request.
   • CIssue long-lived tokens and only validate them at the API gateway.
   • DUse a VPN to ensure the device is on the corporate network before allowing access.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security architect is designing access for edge devices that use federated identities. The architect wants to enforce zero trust by limiting each device's access to only the APIs it needs. Which strategy best achieves this?

   • ARely on the identity provider to enforce access control after issuing the token.
   • BUse a shared service account for all devices to simplify authorization.
   • CAllow all authenticated devices to access all APIs, since they are federated.
   • DUse the federated identity token to derive a device-specific role and enforce that role at the API gateway.
   Reveal Solution Discussion Select an answer first