Examkin

Soru

Zorluk: OrtaIdentity and Access Management Architecture

An organization is upgrading its access control infrastructure to allow third-party contractors temporary access to cloud-hosted management portals and APIs. The security team mandates that credentials must not be statically stored on client devices, identity assertions must be centralized via modern web standards, and access decisions must not rely on internal network perimeter position. Which of the following security mechanisms should be incorporated into this Identity and Access Management (IAM) architecture? (Select TWO.)

  1. Deploying OpenID Connect (OIDC) with OAuth 2.0 to handle federated authentication and short-lived scoped token issuanceCevap
  2. Implementing a Privileged Access Management (PAM) system configured for Just-In-Time (JIT) access and ephemeral credential generationCevap
  3. C
    Configuring a static RADIUS server with MAC Authentication Bypass (MAB) at the network perimeter boundary
  4. D
    Applying discretionary access control (DAC) lists at the network firewall layer to restrict traffic based on contractor client IP addresses

Cevap

The architectural requirement is met by combining OpenID Connect (OIDC) with OAuth 2.0 for federated web/API authentication and a Privileged Access Management (PAM) system utilizing Just-In-Time (JIT) ephemeral credentials.
Combining OpenID Connect (OIDC) with OAuth 2.0 provides standard, federated identity assertions and scoped access tokens for modern cloud portals and APIs. Integrating Privileged Access Management (PAM) configured for Just-In-Time (JIT) access ensures credentials are generated dynamically on demand and automatically invalidated, satisfying the prohibition against static credentials.

Adım Adım Çözüm

1
Analyze requirement for centralized, web-standard identity assertions and token access
Identify OpenID Connect (OIDC) and OAuth 2.0 as the standard federated identity and token-based framework for web portals and APIs
OIDC provides modern identity verification over HTTP/HTTPS while OAuth 2.0 issues temporary scoped tokens instead of static API keys.
2
Analyze requirement to eliminate statically stored client credentials for temporary contractors
Select Just-In-Time (JIT) provisioning within a Privileged Access Management (PAM) architecture
JIT PAM dynamically provisions temporary access and auto-expires credentials, satisfying the constraint against static credential storage.
3
Evaluate and eliminate distractors relying on perimeter boundary trust or improper control types
Reject RADIUS/MAB perimeter mechanisms and static IP firewall rules
Perimeter controls fail to verify identity dynamically at the application level and conflict with zero-trust architectural principles.

Anahtar Kavram

Privileged Access Management (PAM) with Just-In-Time (JIT) Provisioning and OIDC/OAuth2 Federated Architecture
Bu soruyu puanla

Konular

Identity and Access Management Architecture

Bu konudan daha fazla soru