Cloud Identity and Access Management GPCS Practice Questions (Page 12)

Questions 56–59

1. 56foundation · easy

   What is the primary purpose of federated identity in cloud IAM?

   • ATo create separate cloud-specific passwords for every user
   • BTo enforce multi-factor authentication for all cloud users
   • CTo eliminate the need for any authentication in cloud environments
   • DTo allow users to use their existing corporate credentials to access cloud resources
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A company wants to enforce MFA for all users accessing cloud applications. However, they have a group of service accounts used by legacy applications that cannot support MFA. What is the best way to handle this situation?

   • AApply MFA to all users, including service accounts, and break the legacy applications.
   • BCreate a separate tenant for service accounts without MFA.
   • CUse conditional access policies to require MFA for interactive users but exclude service accounts, and instead use managed identities or certificate-based authentication for those accounts.
   • DExclude service accounts from MFA policies and rely on strong passwords.
   Reveal Solution Discussion Select an answer first
4. 58foundation · easy

   What is the primary benefit of using role-based access control (RBAC) over assigning permissions directly to individual users?

   • AIt simplifies permission management by grouping permissions into roles assigned to job functions.
   • BIt automatically rotates passwords for all users.
   • CIt ensures that all users have the same level of access.
   • DIt eliminates the need for authentication.
   Reveal Solution Discussion Select an answer first
5. 59expert · hard

   A large enterprise has a team of database administrators (DBAs) who require temporary, elevated access to production databases. The security team wants to minimize the standing privileges of the DBAs and ensure that all elevated access is approved and audited. The company uses Azure AD and Azure SQL Database. Which solution best meets these requirements?

   • AGrant each DBA the 'SQL DB Contributor' role permanently and rely on SQL Server audit logs.
   • BCreate a SQL Server login with db_owner permissions and share the password with the DBA team.
   • CAssign the DBAs to the Azure AD 'Global Administrator' role and require them to use Azure AD Privileged Identity Management (PIM) to activate the role for a limited time.
   • DCreate a custom Azure AD role scoped to the SQL server resource and use PIM to provide just-in-time access to that role.
   Reveal Solution Discussion Select an answer first