3.3 Recommend Cloud Identity Engine Directory Sync Options NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has two identity sources: an on-premises Active Directory for all employees and a Microsoft Entra ID tenant that contains only guest users from partner organizations. The firewall policy must enforce different access rules for employees and guests. The architect wants to use Cloud Identity Engine to provide both user sets to the firewalls. What is the most appropriate sync strategy?

   • AConfigure SAML 2.0 between AD and Entra ID to merge the two directories into one.
   • BUse only the Entra ID integration and disable the on-premises agent, since Entra ID can sync all users from AD.
   • CUse only the on-premises agent and manually create guest user objects in Active Directory.
   • DDeploy the on-premises agent for AD and also configure the Entra ID integration, then map both directories to the same firewall.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company uses a SAML 2.0 identity provider that is not natively supported by Cloud Identity Engine. They want to use user-ID-based policies on their firewalls. The architect is evaluating whether to use SAML 2.0 or to deploy the on-premises agent with an LDAP proxy. What is the key advantage of using SAML 2.0 in this scenario?

   • ASAML 2.0 eliminates the need for any identity source in Cloud Identity Engine.
   • BSAML 2.0 provides real-time user identity at authentication time, without requiring a separate directory sync.
   • CSAML 2.0 allows the firewall to query the IdP for user groups on demand.
   • DSAML 2.0 is simpler to configure than the on-premises agent for all directory types.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An administrator is deploying the on-premises agent for Cloud Identity Engine in an environment where the Active Directory schema has been extended with custom attributes. The security team wants these custom attributes to be available for user mapping in firewall policies. What must the administrator do to make these attributes available?

   • AUse the Okta integration instead, since it supports custom attributes natively.
   • BConfigure the agent to include the custom attributes in the sync filter and ensure the service account has read access to those attributes.
   • CManually add the attributes to the Cloud Identity Engine portal after the initial sync completes.
   • DReinstall the agent with the 'extended schema' option enabled during installation.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is required to sync a directory from Okta to Cloud Identity Engine?

   • AA SAML 2.0 federation trust between Okta and Cloud Identity Engine
   • BA VPN connection to Okta's data center
   • CAn on-premises agent installed in the same network as Okta
   • DAn API token or OAuth client with permissions to read Okta directory data
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multinational company is deploying Cloud Identity Engine to enable user-ID-based policies across firewalls in three regions. Their user identities are authoritative in an on-premises Active Directory forest that has no internet connectivity from domain controllers. They also have a separate Microsoft Entra ID tenant used only for Microsoft 365, which contains a subset of the same users. The security team wants identity data for all users, including those not in Microsoft 365, available in Cloud Identity Engine with minimal administrative overhead. Which approach should the architect recommend?

   • AUse the Okta integration to pull identities from Okta, which can federate with the on-premises AD and provide all users to Cloud Identity Engine.
   • BDeploy the on-premises agent on a server in each region with network access to both the local domain controllers and the internet, and configure each agent to sync the full directory.
   • CInstall the on-premises agent on a single domain controller in the primary region and point all regions to use that one agent for identity resolution.
   • DConfigure Cloud Identity Engine to sync directly from Microsoft Entra ID, since the company already has a tenant and this avoids on-premises infrastructure.
   Reveal Solution Discussion Select an answer first