An enterprise security architect is designing an updated Identity and Access Management (IAM) architecture to support dynamic, fine-grained authorization across microservices while automating user account lifecycles across cloud services. Which of the following components or standards should be incorporated into the architecture to fulfill these requirements? (Select TWO.)
- A Policy Decision Point (PDP) utilizing Attribute-Based Access Control (ABAC) to evaluate real-time contextual access requestsCevap
- System for Cross-domain Identity Management (SCIM) protocol to automate account provisioning and lifecycle synchronizationCevap
- CPerimeter-based Network Access Control (NAC) rules to grant application privileges based on internal IP subnet locations
- DRADIUS accounting mechanisms to issue SAML assertions directly to external web applications without an Identity Provider
Cevap
The architecture requires combining a Policy Decision Point (PDP) enforcing Attribute-Based Access Control (ABAC) for dynamic access decisions with the System for Cross-domain Identity Management (SCIM) standard for automated identity provisioning.
Attribute-Based Access Control (ABAC) managed by a central Policy Decision Point (PDP) provides fine-grained context-aware authorization decisions across distributed microservices. Simultaneously, the System for Cross-domain Identity Management (SCIM) standard automates user identity creation, modification, and revocation across connected identity domains.
Adım Adım Çözüm
Anahtar Kavram
IAM Architecture Integration: Fine-grained Authorization (PDP/ABAC) and Automated Provisioning (SCIM)