Examkin

Question

Difficulty: Very hardIdentity and Access Management Architecture

An enterprise security architect is evaluating advanced identity and access management (IAM) architectural components to enforce Zero Trust principles and streamline operations across a hybrid enterprise environment. Match each IAM architectural pattern to the specific security or operational requirement it is designed to address.

  • Continuous Access Evaluation Profile (CAEP) / Shared Signals FrameworkEnables near-real-time session revocation and posture re-evaluation across federated relying parties upon security event triggers during active user sessions.
  • System for Cross-domain Identity Management (SCIM)Automates account creation, attribute updates, and deprovisioning workflows across disparate cloud SaaS applications and identity providers.
  • Privileged Access Management (PAM) with Just-In-Time (JIT) AccessEliminates standing administrative privileges on critical systems by granting ephemeral credentials tied to approved change tickets.
  • OAuth 2.0 Mutual-TLS (mTLS) Client Authentication and Certificate-Bound Access TokensMitigates token interception and replay attacks in API communication by cryptographically binding access tokens to the caller's X.509 transport connection.

Answer

Continuous Access Evaluation Profile (CAEP) matches real-time session revocation across federated relying parties. System for Cross-domain Identity Management (SCIM) matches automated account lifecycle provisioning across SaaS applications. Privileged Access Management (PAM) with Just-In-Time (JIT) access matches eliminating standing administrative privileges via ephemeral credentials. OAuth 2.0 mTLS client authentication and certificate-bound access tokens matches mitigating token replay attacks by cryptographically binding access tokens to transport connections.
Each IAM architecture pattern is aligned to its primary security function: CAEP provides event-driven continuous session re-evaluation; SCIM standardizes automated cross-domain identity lifecycle management; PAM with JIT provisions ephemeral privileges to eliminate standing access; and OAuth 2.0 mTLS cryptographically binds access tokens to client transport connections to prevent replay attacks.

Step-by-Step Solution

1
Analyze the requirement for mid-session revocation upon security triggers.
Identify CAEP / Shared Signals Framework, which continuously passes telemetry between IdPs and RPs to terminate sessions dynamically.
Standard SAML/OIDC access tokens are stateless and valid until expiration; CAEP addresses this limitation by broadcasting security events out-of-band.
2
Analyze the requirement for automated provisioning/deprovisioning across SaaS apps.
Identify SCIM as the standard protocol for schema-based user identity lifecycle management.
SCIM standardizes RESTful APIs for managing users and groups across different identity domains.
3
Analyze the requirement to eliminate standing administrative privileges.
Identify PAM with JIT Access, which provisions ephemeral credentials only when required for approved operations.
Standing access increases attack surface; JIT access enforces temporary privilege granting.
4
Analyze the requirement to protect API communication against token replay attacks.
Identify OAuth 2.0 mTLS / Certificate-Bound Tokens, which associate the access token with the client's TLS client certificate.
Sender-constrained tokens prevent attackers who capture a bearer token from using it on a different TLS connection.

Key Concept

Advanced Enterprise IAM Architecture and Protocols
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic