Examkin

Question

Difficulty: MediumIdentity and Access Management Architecture

An organization is designing an automated identity lifecycle architecture to synchronize user identity state between its cloud-based HR system and its central Identity Provider (IdP). Which of the following requirements must be implemented within this architecture to support secure automated user provisioning and real-time deprovisioning? (Select TWO).

  1. Implementation of standardized System for Cross-domain Identity Management (SCIM) service endpoints to automate identity schema operations between systems.Answer
  2. Deployment of centralized session revocation mechanisms to invalidate active tokens and application access upon user status change signals.Answer
  3. C
    Reliance on internal perimeter firewall rules to filter resource requests from terminated employees while keeping active identity tokens intact.
  4. D
    Prompting users to re-enter primary authentication credentials for each granular API call to evaluate resource entitlement boundaries.

Answer

Standardized System for Cross-domain Identity Management (SCIM) endpoints must be implemented for automated identity schema operations, along with centralized session revocation mechanisms to invalidate active application tokens upon deprovisioning.
Automating identity provisioning between HR platforms and centralized Identity Providers requires SCIM service endpoints to standardize user schema updates and deprovisioning calls across multi-tenant applications. Furthermore, to prevent unauthorized access via active sessions after account suspension, the architecture must incorporate centralized token and session revocation capabilities across all downstream relying parties.

Step-by-Step Solution

1
Analyze identity lifecycle architecture requirements for cloud HR to IdP integration.
Identified the requirement for automated, standardized provisioning and deprovisioning protocols.
SCIM is the industry standard protocol built explicitly for exchange of user identity information across independent domains.
2
Evaluate deprovisioning security controls to prevent orphaned account exploitation.
Determined that session revocation mechanisms must propagate status changes immediately.
Deprovisioning an account in the IdP is insufficient if active OAuth tokens or SAML sessions remain valid on target applications.
3
Distinguish correct architectural solutions from misconfigurations and conceptual errors.
Selected SCIM and session revocation while eliminating perimeter-only defenses and authentication/authorization confusion.
Perimeter firewalls do not protect cloud-hosted resources, and credential prompts handle identity verification rather than authorization rights.

Key Concept

Automated Identity Lifecycle & Provisioning Architecture
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic