Examkin

Soru

Zorluk: OrtaIdentity and Access Management Architecture

A security architect is designing an Identity and Access Management (IAM) architecture for a microservices-based application deployed across multiple cloud environments. To align with Zero Trust principles, the architecture must issue short-lived, cryptographically verifiable identities to service workloads and decouple fine-grained authorization enforcement from application code. Which of the following protocols or architectural components should the architect integrate to satisfy these requirements? (Select TWO.)

  1. SPIFFE/SPIRE framework to automatically mint and distribute short-lived cryptographic workload identities to running services.Cevap
  2. Decoupled Policy Decision Points (PDP) running as sidecar proxies alongside services to evaluate centralized authorization policies.Cevap
  3. C
    Static API keys stored in environment variables to authenticate microservices across internal VPC subnets without key management overhead.
  4. D
    Network-level IP address filtering on perimeter firewalls to handle authorization decision logic for incoming service requests.

Cevap

The architecture should implement the SPIFFE/SPIRE framework for workload identity attestation and decoupled Policy Decision Points (PDPs) as sidecar proxies for centralized authorization evaluation.
Implementing SPIFFE/SPIRE provides cryptographically verifiable, short-lived workload identities (SVIDs) for microservices across dynamic environments. Integrating decoupled Policy Decision Points (PDPs) via sidecar proxies allows authorization policies to be updated and evaluated centrally without altering microservice application logic.

Adım Adım Çözüm

1
Identify workload identity requirements for dynamic microservice containers.
Recognize that SPIFFE/SPIRE establishes automated, short-lived, cryptographically verifiable identity documents (SVIDs) for workloads without relying on IP addresses or static credentials.
Microservices require dynamic workload attestation and identity propagation across cloud boundaries under Zero Trust.
2
Determine the appropriate pattern for decoupling fine-grained authorization logic.
Select sidecar-based Policy Decision Points (PDPs) that intercept requests and enforce access policies centrally.
Decoupling authorization logic from application code ensures consistent policy enforcement across heterogeneous services.

Anahtar Kavram

Workload Identity and Decoupled Authorization in IAM Architecture
Bu soruyu puanla

Konular

Identity and Access Management Architecture

Bu konudan daha fazla soru