An enterprise security architect is designing an Identity and Access Management (IAM) framework to integrate a newly acquired subsidiary into the organization's cloud identity infrastructure. The solution must provide cross-domain web-based federated Single Sign-On (SSO) for web applications, automate real-time user identity lifecycle provisioning and deprovisioning between the Identity Provider (IdP) and third-party SaaS platforms, and align strictly with Zero Trust architecture principles. Which of the following architectural standards and protocols should the architect deploy to fulfill these requirements? (Select TWO).
- Security Assertion Markup Language (SAML) 2.0 to enable cross-domain web browser federated authenticationAnswer
- System for Cross-domain Identity Management (SCIM) 2.0 to automate user account lifecycle provisioning and synchronization across platformsAnswer
- CRemote Authentication Dial-In User Service (RADIUS) combined with static IPsec tunnels to establish implicit trust for all internal network segments
- DOAuth 2.0 access tokens formatted as simple authorization credentials to serve directly as user identity authentication assertions for web browser sessions
Answer
The architect must deploy Security Assertion Markup Language (SAML) 2.0 for federated web Single Sign-On and System for Cross-domain Identity Management (SCIM) 2.0 for automated user account lifecycle provisioning.
To achieve modern, secure IAM architecture in a hybrid Zero Trust enterprise, SAML 2.0 provides standard XML-based security assertions for cross-domain web federated authentication. Simultaneously, SCIM 2.0 provides an open RESTful specification specifically tailored to streamline and automate identity lifecycle management (provisioning, updates, and offboarding) across disparate cloud application ecosystems.
Step-by-Step Solution
Key Concept
Identity Federation Protocols (SAML/OIDC) and Automated Identity Provisioning Standards (SCIM)