Examkin

Question

Difficulty: HardIdentity and Access Management Architecture

An enterprise security architect is designing a modern Identity and Access Management (IAM) architecture to support a hybrid enterprise workforce. The solution must provide phishing-resistant, passwordless authentication for corporate users accessing cloud services, while automatically synchronizing user onboarding, role updates, and offboarding privileges from the central Identity Provider (IdP) to external Software as a Service (SaaS) platforms in near real-time. Which of the following protocols or standards should the architect integrate into the IAM architecture to fulfill these requirements? (Select TWO.)

  1. WebAuthn / FIDO2 framework to establish challenge-response authentication using asymmetric key pairs bound to origin domainsAnswer
  2. B
    LDAP over SSL (LDAPS) directory queries routed directly from external cloud SaaS platforms to internal domain controllers
  3. System for Cross-domain Identity Management (SCIM) RESTful API schema to automate cloud account provisioning and lifecycle attribute syncAnswer
  4. D
    OAuth 2.0 Implicit Grant flow to exchange authorization tokens for automated user account provisioning across client applications

Answer

The architect must integrate the WebAuthn / FIDO2 framework for passwordless phishing-resistant authentication and the System for Cross-domain Identity Management (SCIM) standard for automated user provisioning.
WebAuthn / FIDO2 supplies passwordless, origin-bound public key authentication that inherently resists social engineering and phishing attacks. System for Cross-domain Identity Management (SCIM) provides the standardized REST API specifications necessary to push real-time user creation, modifications, and revocations from the IdP to cloud SaaS services.

Step-by-Step Solution

1
Analyze the requirement for phishing-resistant, passwordless authentication across cloud services.
Identify WebAuthn / FIDO2 as the standard architectural specification that uses hardware-bound public-key cryptography to prevent phishing and credential harvest attacks.
WebAuthn binds credentials directly to the website origin, preventing relay attacks common in legacy MFA.
2
Analyze the requirement for automated cross-domain identity lifecycle synchronization (onboarding, role changes, offboarding) to cloud SaaS platforms.
Identify System for Cross-domain Identity Management (SCIM) as the industry standard protocol designed for managing user identity lifecycles across distinct domains via HTTP REST APIs.
SCIM standardizes user object schemas and endpoints so IdPs can push automated creation, update, and deprovisioning events to SaaS targets.
3
Evaluate and eliminate non-viable architectural choices.
Reject direct internal LDAPS exposures due to network perimeter risks and reject OAuth 2.0 Implicit Grant due to security deprecation and its functional focus on access delegation rather than provisioning.
Ensures adherence to modern Zero Trust architecture and secure IAM protocol separation.

Key Concept

Identity and Access Management Architecture: Phishing-Resistant Authentication and Automated Lifecycle Provisioning
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic