Edge Identity and Authentication GCSA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company uses edge devices that run containerized workloads. They want to ensure that only containers from their trusted registry are deployed. Which control should they implement?

   • AScan images for vulnerabilities and block those with critical findings.
   • BUse a container runtime that only allows images from a specific repository.
   • CEnable container image signing in the registry and verify signatures on the edge device before pulling or running the image.
   • DUse a private registry and rely on network access controls to prevent unauthorized images.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a key characteristic of mutual TLS (mTLS) as an authentication method for edge services?

   • AOnly the server presents a certificate to the client
   • BIt only authenticates the client, not the server
   • CIt uses a shared secret key for encryption and authentication
   • DBoth the client and the server authenticate each other using certificates
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the purpose of verifying the integrity of an edge component's firmware or software image?

   • ATo increase the processing speed of the edge device
   • BTo simplify the installation process for non-technical users
   • CTo ensure the component has not been tampered with or corrupted
   • DTo reduce the power consumption of the edge device
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A multinational corporation has edge services in multiple countries. They use an identity federation solution for SSO. However, they have a regulatory requirement that user authentication data for users in a specific country must not leave that country's borders. What is the best way to meet this requirement while maintaining SSO?

   • AUse the global identity provider for all users and rely on encryption to protect the data in transit.
   • BDeploy a local identity provider in that country that federates with the global identity provider using a brokered trust model, ensuring authentication data stays local.
   • CCreate separate local accounts for users in that country and do not federate them.
   • DUse a VPN to route authentication traffic through the country's local data center.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A retail company deploys point-of-sale (POS) edge devices in stores that connect to a central cloud backend over the internet. Each device must authenticate to the backend without storing long-lived credentials on the device. The security team wants to ensure that if a device is physically compromised, the attacker cannot reuse its credentials to impersonate other devices. Which approach best meets these requirements?

   • ADeploy a username and password for each device, stored in a plaintext configuration file on the device.
   • BAuthenticate each device using its MAC address and an IP allowlist in the cloud backend.
   • CUse a shared API key embedded in the device firmware for all POS devices, and rotate it quarterly.
   • DIssue each device a unique client certificate, store the private key in the device's hardware security module (HSM), and use mutual TLS with short-lived session tokens.
   Reveal Solution Discussion Select an answer first