5.3 - Federated Identity with a Third-Party Service CISSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has on-premises Active Directory and a cloud-based IdP. They want to enable SSO for all applications, but they have a regulatory requirement that authentication for certain on-premises applications must not rely on the cloud IdP. What is the best approach?

   • AKeep two separate identity stores with no synchronization.
   • BUse a single on-premises IdP for everything and disable the cloud IdP.
   • CUse a hybrid federation design where on-premises applications authenticate against the on-premises IdP, and cloud applications use the cloud IdP with synced identities.
   • DMove all authentication to the cloud IdP and disable on-premises authentication.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a federated identity model, what is the role of a third-party service?

   • AIt provides a common user interface for all applications, regardless of authentication
   • BIt stores encrypted copies of all users' passwords for backup purposes
   • CIt acts as the identity provider that authenticates users and provides identity information to relying parties
   • DIt replaces the need for any identity provider by using a shared database of all users
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An organization uses an on-premises identity provider and wants to federate with a third-party service that only supports OAuth 2.0. The organization's IdP only supports SAML. What is the best way to enable SSO without changing the IdP?

   • ADeploy a federation gateway that translates SAML to OAuth tokens.
   • BUse a cloud-based IdP that supports OAuth and sync identities from on-prem.
   • CCreate a separate account for each user in the third-party service.
   • DAsk the third-party service to support SAML.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a hybrid federation setup, what is the typical role of directory synchronization?

   • AIt replicates user identities between the on-premise directory and the cloud identity provider
   • BIt encrypts all user passwords for storage in the cloud
   • CIt replaces the need for any identity provider
   • DIt creates separate user accounts in each environment
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a common benefit of using a cloud-based identity provider for federation?

   • AIt guarantees that all user data remains within the organization's network
   • BIt requires no trust relationship with the third-party service
   • CIt eliminates the need for any authentication protocols
   • DIt reduces the need to maintain on-premise identity infrastructure
   Reveal Solution Discussion Select an answer first