Examkin

Question

Difficulty: HardIdentity and Access Management Architecture

A cloud security engineering team is designing an Identity and Access Management (IAM) architecture for microservices operating across multi-cloud Kubernetes environments. The architecture must enforce Zero Trust principles by replacing static API keys and long-lived service account tokens with short-lived X.509 certificates issued automatically through platform attestation rather than user credentials. Which of the following identity architecture solutions best satisfies these requirements?

  1. Implement SPIFFE/SPIRE workload identities to issue verifiable cryptographic credentials based on node and workload attestation.Answer
  2. B
    Establish IPsec VPN tunnels between cluster nodes to secure inter-service network traffic using pre-shared keys.
  3. C
    Configure SAML 2.0 Web Browser Single Sign-On (SSO) with HTTP POST bindings for service-to-service authentication.
  4. D
    Deploy OAuth 2.0 Implicit Grant flows to distribute bearer tokens stored in container environment variables.

Answer

SPIFFE/SPIRE workload identities providing short-lived cryptographic credentials via platform attestation.
SPIFFE/SPIRE (Secure Production Identity Framework for Everyone / SPIFFE Runtime Environment) is specifically engineered for workload identity architecture in heterogeneous cloud environments. It performs node and workload attestation to automatically issue short-lived, verifiable SPIFFE ID X.509 documents (SVIDs), fulfilling Zero Trust requirements for microservices without static secret management.

Step-by-Step Solution

1
Analyze the core architectural requirement
The requirement specifies non-person workload authentication across multi-cloud clusters using short-lived cryptographic identity issued via automated platform attestation.
Static credentials and network-level trust boundaries violate Zero Trust principles in dynamic cloud-native environments.
2
Evaluate workload identity standards
SPIFFE (Secure Production Identity Framework for Everyone) defines a framework for workload identity, and SPIRE provides the implementation to attest platforms and issue short-lived X.509 SVIDs.
This establishes cryptographically verifiable workload identity without relying on human interaction or static secrets.
3
Eliminate inappropriate identity and network mechanisms
IPsec relies on perimeter/node-level security; SAML 2.0 target user browser SSO; OAuth 2.0 Implicit Grant is insecure and suited for front-end clients.
None of these alternatives provide workload-level platform attestation for containerized microservices.

Key Concept

Workload Identity and Platform Attestation in Zero Trust IAM Architecture
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic