CAS-002 · Question #568
Company ABC has grown yearly through mergers and acquisitions. This has led to over 200 internal custom web applications having standalone identity stores. In order to reduce costs and improve…
The correct answer is A. Build an organization-wide fine grained access control model stored in a centralized policy D. Implement a web access controlled reverse proxy and centralized directory model providing E. Implement automated provisioning of identity information; coarse grained, and fine grained. Centralizing identity management across 200 web applications requires a standardized policy model, an efficient reverse proxy with centralized directory, and automated provisioning to reduce costs and improve consistency.
Question
Company ABC has grown yearly through mergers and acquisitions. This has led to over 200 internal custom web applications having standalone identity stores. In order to reduce costs and improve operational efficiencies a project has been initiated to implement a centralized security infrastructure. The requirements are as follows:
- Reduce costs
- Improve efficiencies and time to market
- Manageable
- Accurate identity information
- Standardize on authentication and authorization
- Ensure a reusable model with standard integration patterns
Which of the following security solution options will BEST meet the above requirements? (Select THREE).
Options
- ABuild an organization-wide fine grained access control model stored in a centralized policy
- BImplement self service provisioning of identity information, coarse grained, and fine grained
- CImplement a web access control agent based model with a centralized directory model
- DImplement a web access controlled reverse proxy and centralized directory model providing
- EImplement automated provisioning of identity information; coarse grained, and fine grained
- FMove each of the applications individual fine grained access control models into a centralized
- GImplement a web access control forward proxy and centralized directory model, providing
How the community answered
(21 responses)- A62% (13)
- B10% (2)
- C5% (1)
- G24% (5)
Why each option
Centralizing identity management across 200 web applications requires a standardized policy model, an efficient reverse proxy with centralized directory, and automated provisioning to reduce costs and improve consistency.
A centralized fine-grained access control policy provides a single authoritative model that all applications can reference, enabling standardization and a reusable authorization framework without duplicating logic per application.
Self-service provisioning introduces risk of inaccurate identity data and reduces administrative control; the requirements specifically call for accurate identity information and managed standardization.
An agent-based model requires deploying and maintaining an agent on each of the 200+ applications, increasing operational complexity rather than reducing it compared to a centralized reverse proxy approach.
A web access control reverse proxy intercepts requests before they reach applications and enforces authentication and authorization against a centralized directory (such as LDAP/AD), eliminating the need for per-application identity stores and enabling standard integration patterns.
Automated provisioning ensures identity information is accurate and consistently propagated across all systems at scale, directly reducing manual operational overhead and improving time to market for new user onboarding.
Migrating each application's individual fine-grained access control model into a central store preserves fragmented, application-specific logic rather than standardizing on a reusable shared policy model.
A forward proxy handles outbound client traffic to external destinations; it cannot intercept and enforce authentication for inbound requests to internal web applications the way a reverse proxy can.
Concept tested: Centralized IAM architecture with reverse proxy and automated provisioning
Source: https://csrc.nist.gov/publications/detail/sp/800-162/final
Topics
Community Discussion
No community discussion yet for this question.