3.3 Recommend Cloud Identity Engine Directory Sync Options NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which type of credential is commonly used to authenticate Cloud Identity Engine to Okta for directory sync?

   • AClient certificate
   • BAPI token
   • CSAML assertion
   • DUsername and password of a regular user
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has both Microsoft Entra ID and Okta tenants. They want to use Cloud Identity Engine to provide user identity to their firewalls. The architect needs to decide which directory to sync. What is the primary consideration when choosing between Entra ID and Okta as the sync source?

   • AThe directory that is authoritative for the users and groups that need to be mapped in firewall policies.
   • BThe directory that has the most users, regardless of whether those users are relevant to the firewall policies.
   • CThe directory that requires the least configuration effort, even if it is not the authoritative source.
   • DThe directory that supports SAML 2.0, since that is required for directory sync.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security administrator notices that user and group changes made in on-premises Active Directory are not appearing in Cloud Identity Engine within the expected time frame. The on-premises agent is running and shows a healthy status. What is the most likely cause of the delay?

   • AThe agent requires a restart after every directory change to pick up the new data.
   • BThe agent is unable to read the changes because the domain controller is read-only.
   • CThe agent only syncs on manual triggers from the Cloud Identity Engine web interface.
   • DThe agent performs incremental syncs on a scheduled interval, so changes are not pushed in real time.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Where is the on-premises agent for Cloud Identity Engine typically deployed?

   • AOn a cloud-hosted virtual machine in a different region
   • BOn a client workstation
   • COn the firewall itself
   • DOn a server within the on-premises network that can reach the directory source
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is required to sync a directory from Microsoft Entra ID (Azure AD) to Cloud Identity Engine?

   • AA SAML 2.0 federation trust between Entra ID and Cloud Identity Engine
   • BA service principal or app registration with appropriate permissions in Entra ID
   • CAn on-premises agent installed in the same network as Entra ID
   • DA VPN connection to Microsoft's data center
   Reveal Solution Discussion Select an answer first