Examkin

Question

Difficulty: MediumIdentity and Access Management Architecture

An organization is designing an updated Identity and Access Management (IAM) architecture for its enterprise applications. The security team needs to support automated user account lifecycle management (creation, updates, and deprovisioning) across multiple third-party SaaS platforms. Additionally, they must implement a fine-grained access control mechanism capable of making real-time authorization decisions based on dynamic contextual attributes such as user location, device security posture, and time of access. Which of the following technologies should the security architect incorporate into the IAM architecture to satisfy these requirements? (Select TWO.)

  1. System for Cross-domain Identity Management (SCIM) for automated identity provisioning across cloud platformsAnswer
  2. Attribute-Based Access Control (ABAC) for evaluating dynamic contextual risk factors during authorization decisionsAnswer
  3. C
    Security Assertion Markup Language (SAML) 2.0 Web Browser SSO profile for batch user lifecycle database synchronization
  4. D
    Implicit network perimeter IP address whitelisting to grant internal directory access based on network location

Answer

The architecture should incorporate System for Cross-domain Identity Management (SCIM) for user account provisioning and Attribute-Based Access Control (ABAC) for dynamic authorization based on contextual attributes.
The correct options are System for Cross-domain Identity Management (SCIM) and Attribute-Based Access Control (ABAC). SCIM automates user identity exchange and lifecycle provisioning across disparate cloud systems. ABAC enables policy rules based on subject, resource, and environmental attributes (such as location and device posture), allowing real-time context-aware authorization.

Step-by-Step Solution

1
Analyze the account lifecycle management requirement.
System for Cross-domain Identity Management (SCIM) is identified as the standard protocol designed for automated provisioning, updating, and deprovisioning of user identities across cloud platforms.
SCIM standardizes the schema and RESTful APIs for managing user identities across separate security domains.
2
Analyze the access control and authorization decision requirement.
Attribute-Based Access Control (ABAC) is identified as the access control model that evaluates user, resource, and environmental attributes (such as device health and location) to make real-time decisions.
Unlike static Role-Based Access Control (RBAC), ABAC incorporates dynamic contextual conditions into policy enforcement.

Key Concept

IAM protocols and access control models for cloud identity provisioning and dynamic authorization.
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic