Examkin

Soru

Zorluk: Çok zorIdentity and Access Management Architecture

A global healthcare organization requires a federated access solution allowing external medical specialists from partner hospitals to query patient diagnostic APIs hosted in its cloud environment. The architecture must ensure partner organizations maintain control over their own user credentials, support identity assertion, enable fine-grained attribute-based access decisions at the API gateway without exposing internal directory services, and avoid establishing persistent network-level perimeter trust. Which architectural combination of identity and authorization frameworks best satisfies these security requirements?

  1. OpenID Connect (OIDC) for user identity assertion combined with OAuth 2.0 access tokens evaluated at the API gateway for authorizationCevap
  2. B
    OAuth 2.0 client credentials grant secured by mutual TLS (mTLS) to authenticate external specialists directly against the internal directory
  3. C
    RADIUS federation using EAP-TLS paired with IPsec site-to-site tunnels to establish continuous network access to API endpoints
  4. D
    Kerberos cross-realm trust configured with SAML 2.0 HTTP Artifact Binding to issue local Ticket Granting Tickets for external API access

Cevap

OpenID Connect (OIDC) for user identity assertion combined with OAuth 2.0 access tokens evaluated at the API gateway for authorization
Combining OpenID Connect (OIDC) with OAuth 2.0 directly satisfies federated access, decentralized credential management, and Zero Trust API protection. OIDC acts as the identity layer enabling external Identity Providers (IdPs) to assert user identity using signed JSON Web Tokens (JWTs). OAuth 2.0 provides delegated authorization, passing access tokens containing scopes and claims to the cloud API gateway for fine-grained enforcement without exposing legacy internal directory services or relying on perimeter network connectivity.

Adım Adım Çözüm

1
Analyze identity federation and credential boundary requirements
External partner organizations must manage their own credentials, requiring an external Identity Provider (IdP) capable of issuing standardized identity assertions.
Direct credential sharing or internal directory registration violates federation architecture principles.
2
Evaluate API authorization enforcement mechanics
OAuth 2.0 access tokens containing JSON Web Token (JWT) scopes and user claims allow the API gateway to enforce fine-grained attribute-based access control (ABAC).
Application programming interfaces (APIs) require stateless token verification at the gateway layer rather than legacy session cookies or network-level checks.
3
Synthesize OIDC and OAuth 2.0 roles into the final architecture
OIDC handles the authentication ('who the specialist is') via ID tokens from the partner IdP, while OAuth 2.0 handles authorization ('what APIs the specialist can access') via access tokens.
Combining OIDC for identity assertion with OAuth 2.0 for API access control meets all security, cloud compatibility, and Zero Trust requirements.

Anahtar Kavram

Federated Identity and API Authorization Architecture (OIDC & OAuth 2.0)
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Identity and Access Management Architecture

Bu konudan daha fazla soru