Examkin

Question

Difficulty: Very hardIdentity and Access Management Architecture

An enterprise security architect is redesigning identity infrastructure to align with Zero Trust principles for a hybrid workforce. The organization must support real-time token revocation and risk evaluation for SaaS resources when user posture changes, as well as eliminate persistent administrator credentials on legacy infrastructure by enforcing ephemeral privilege allocation. Which TWO of the following identity and access management architecture components or protocols must be implemented to fulfill these requirements?

  1. Identity Provider (IdP) integration supporting the Continuous Access Evaluation Protocol (CAEP) and Shared Signals FrameworkAnswer
  2. Privileged Access Management (PAM) vault utilizing Just-In-Time (JIT) provisioning and short-lived ephemeral credentialsAnswer
  3. C
    Perimeter IPsec VPN concentrator enforcing PAP authentication against a centralized RADIUS server for internal segment access
  4. D
    Legacy LDAP directory schema updates enforcing Role-Based Access Control (RBAC) to handle session revocation across federated cloud services

Answer

The correct architecture requires integrating an Identity Provider supporting the Continuous Access Evaluation Protocol (CAEP) alongside a Privileged Access Management (PAM) framework utilizing Just-In-Time (JIT) provisioning with ephemeral credentials.
Zero Trust IAM architecture requires continuous risk evaluation and minimization of standing privileges. Implementing CAEP (Continuous Access Evaluation Protocol) allows IdPs and SaaS platforms to exchange real-time security events to revoke access tokens immediately upon risk detection. Implementing a PAM vault with JIT temporary credentials removes standing administrator accounts by dynamically assigning short-lived privileges only when required.

Step-by-Step Solution

1
Analyze requirement 1: Dynamic session revocation and real-time posture risk evaluation across SaaS apps.
Identify that standard OAuth2/OIDC refresh token lifecycles are periodic; Continuous Access Evaluation Protocol (CAEP) / Shared Signals Framework enables real-time event-driven session revocation across identity providers and relying parties.
Enforces continuous verification rather than trusting static long-lived tokens.
2
Analyze requirement 2: Elimination of persistent privileged accounts on internal server infrastructure.
Identify Privileged Access Management (PAM) with Just-In-Time (JIT) credentialing as the standard architectural control for dynamic temporary elevation without standing administrative permissions.
Minimizes the blast radius of credential harvesting by ensuring privileged credentials expire immediately after administrative tasks.

Key Concept

Zero Trust IAM Architecture, CAEP, and Privileged Access Management (PAM)
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic