Examkin

Soru

Zorluk: OrtaIdentity and Access Management Architecture

A software engineering team is developing a backend service that must automatedly transmit sensitive transaction audit logs to an external analytics vendor's endpoint. The security team specifies that the integration must eliminate static, long-lived API keys in application configuration files and support short-lived, cryptographically verifiable tokens for machine-to-machine authentication. Which of the following identity and access management architecture solutions should be implemented to satisfy these requirements?

  1. Implement OAuth 2.0 Client Credentials Grant to request short-lived JSON Web Tokens (JWTs) directly from the vendor's authorization server.Cevap
  2. B
    Configure SAML 2.0 Web Browser Single Sign-On (SSO) using identity provider metadata and XML-based authentication assertions for the service account.
  3. C
    Restrict endpoint traffic using IP address whitelisting and HTTP Basic Authentication over an isolated network tunnel.
  4. D
    Deploy an inline Web Application Firewall (WAF) to inspect outgoing HTTP payloads for hardcoded API key patterns before transmission.

Cevap

Implementing OAuth 2.0 Client Credentials Grant with short-lived JSON Web Tokens (JWTs) issued by the vendor's authorization server provides secure, automated machine-to-machine authentication without static credentials.
The correct solution uses the OAuth 2.0 Client Credentials grant, which allows a client service to authenticate directly with an authorization server using its client credentials and obtain a short-lived JSON Web Token (JWT). This satisfies both the machine-to-machine automation requirement and the security policy prohibiting static long-lived keys.

Adım Adım Çözüm

1
Analyze the authentication context requirements
Identified a machine-to-machine (M2M) automated interaction requirement without human user interaction.
Different IAM flows are tailored for interactive user authentication versus automated backend service authorization.
2
Evaluate token management and credential life-cycle constraints
Determined that static API keys must be replaced with short-lived, cryptographically signed tokens.
Short-lived tokens limit the exposure window if a credential is compromised and remove stored secrets from application source files.
3
Select the appropriate IAM protocol for non-interactive backend authorization
Chose OAuth 2.0 Client Credentials grant generating short-lived JWTs.
Client Credentials grant is the industry-standard IAM architecture pattern for service-to-service access control.

Anahtar Kavram

Machine-to-Machine (M2M) Authentication and OAuth 2.0 Client Credentials Grant
Bu soruyu puanla

Konular

Identity and Access Management Architecture

Bu konudan daha fazla soru