Examkin

Soru

Zorluk: Çok zorIdentity and Access Management Architecture

A financial enterprise is migrating its identity architecture to a cloud-hosted Identity Provider (IdP) while retaining a mission-critical legacy on-premises web application. The legacy application relies strictly on Integrated Windows Authentication (Kerberos) for user authentication and cannot be modified to support modern web standards such as SAML 2.0 or OpenID Connect (OIDC). Remote employees connect from unmanaged endpoints without direct line-of-sight network connectivity to internal Active Directory Domain Controllers. Which architectural pattern should the security team implement to provide secure single sign-on (SSO) to this application while maintaining a Zero Trust security posture?

  1. Deploy an Identity-Aware Proxy (IAP) combined with an on-premises application connector that performs Kerberos Constrained Delegation (KCD) after verifying modern IdP claims.Cevap
  2. B
    Configure an inline Web Application Firewall (WAF) to inspect incoming HTTP requests and forward RADIUS accounting packets directly to internal Active Directory services.
  3. C
    Establish an enterprise IPsec VPN gateway to extend the internal network boundary, enabling remote endpoints to issue Kerberos Ticket-Granting Tickets (TGT) directly to Domain Controllers.
  4. D
    Install a Host-based Intrusion Prevention System (HIPS) on the web server to translate incoming OAuth 2.0 access tokens into local NTFS file system permissions.

Cevap

Deploying an Identity-Aware Proxy (IAP) with an on-premises connector that executes Kerberos Constrained Delegation (KCD) allows modern IdP authentication for remote users while translating claims into native Kerberos tickets internally without broad network exposure.
An Identity-Aware Proxy (IAP) pattern combined with Kerberos Constrained Delegation (KCD) solves the challenge of supporting legacy Kerberos authentication for remote users without compromising Zero Trust principles. The remote user authenticates against the modern cloud Identity Provider using strong controls (such as MFA). Upon successful authentication, the IAP connector residing within the internal network receives a secure signal and uses KCD to request a Kerberos service ticket on behalf of the user from Active Directory, delivering it to the legacy application.

Adım Adım Çözüm

1
Analyze legacy application requirements
Identified Kerberos (Integrated Windows Authentication) as an unalterable protocol dependency that requires valid Active Directory Kerberos tickets for session establishment.
Legacy applications lacking SAML/OIDC support cannot consume modern claims directly.
2
Evaluate remote access and Zero Trust boundary constraints
Remote endpoints are unmanaged and lack direct line-of-sight to Domain Controllers, ruling out traditional perimeter network extension mechanisms.
Exposing internal domain services directly to remote endpoints breaches Zero Trust segmentation boundaries.
3
Select the appropriate IAM architectural bridge mechanism
An Identity-Aware Proxy (IAP) authenticates the remote client via the cloud IdP using modern standards, and an internal agent uses Kerberos Constrained Delegation (KCD) to impersonate the authenticated user to the backend web server.
KCD bridges modern identity federation protocols with legacy Windows authentication seamlessly and securely.

Anahtar Kavram

Identity and Access Management Architecture - Legacy SSO Integration & Zero Trust Proxy Patterns
Bu soruyu puanla

Konular

Identity and Access Management Architecture

Bu konudan daha fazla soru