Examkin

Question

Difficulty: HardIdentity and Access Management Architecture

An enterprise security architecture team is redesigning identity federations across several vendor SaaS applications. To align with Zero Trust principles, the organization requires immediate session termination and access token revocation across all connected SaaS applications the moment an identity risk signal (such as impossible travel or device compliance failure) is detected at the central Identity Provider (IdP), rather than waiting for OAuth access tokens or SAML assertions to expire naturally. Which of the following identity architectural mechanisms best fulfills this real-time session security requirement?

  1. Implement Shared Signals and Events using the Continuous Access Evaluation Protocol (CAEP) between the IdP and relying parties.Answer
  2. B
    Schedule automated System for Cross-domain Identity Management (SCIM) batch synchronization workflows to execute every five minutes.
  3. C
    Restrict SaaS access to requests originating from verified enterprise egress IP ranges using web application firewall perimeter rules.
  4. D
    Require step-up Multi-Factor Authentication (MFA) during the initial single sign-on (SSO) login flow for all high-privilege roles.

Answer

Implementing Shared Signals and Events using the Continuous Access Evaluation Protocol (CAEP) between the Identity Provider (IdP) and relying party applications.
The correct answer specifies implementing the Continuous Access Evaluation Protocol (CAEP). CAEP allows Identity Providers to communicate real-time security events (such as session revoking events, password changes, or device compliance changes) to connected relying party applications instantly. This satisfies the requirement for dynamic, continuous access evaluation under Zero Trust without relying on token expiration windows.

Step-by-Step Solution

1
Analyze the core architectural requirement
The scenario requires real-time, event-driven session revocation across federated SaaS platforms upon IdP risk detection, bypassing traditional token TTL expirations.
Standard OAuth 2.0 access tokens and SAML assertions are stateless and valid until expiration unless explicitly revoked via real-time signal streams.
2
Evaluate identity protocols for active session control
CAEP allows the IdP to push real-time Security Event Tokens (SETs) directly to relying parties when user risk changes, instantly revoking or re-evaluating sessions.
This directly enforces continuous identity evaluation as mandated by modern Zero Trust architecture.
3
Differentiate from secondary provisioning or perimeter controls
SCIM handles user account identity lifecycle provisioning (not session events), network IP filters rely on perimeter trust, and initial MFA only inspects authentication at login time.
None of these secondary controls provide active, cross-domain continuous session revocation.

Key Concept

Continuous Access Evaluation Protocol (CAEP) in IAM Architecture
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic