CAS-003 · Question #319
The Chief Information Officer (CIO) wants to increase security and accessibility among the organization's cloud SaaS applications. The applications are configured to use passwords, and two-factor…
The correct answer is D. Implement an IdP that supports SAML and time-based, one-time passwords. An IdP using SAML federation provides single sign-on to improve accessibility across all SaaS apps, while TOTP adds a second authentication factor that the apps do not natively support.
Question
The Chief Information Officer (CIO) wants to increase security and accessibility among the organization's cloud SaaS applications. The applications are configured to use passwords, and two-factor authentication is not provided natively. Which of the following would BEST address the CIO's concerns?
Options
- AProcure a password manager for the employees to use with the cloud applications.
- BCreate a VPN tunnel between the on-premises environment and the cloud providers.
- CDeploy applications internally and migrate away from SaaS applications.
- DImplement an IdP that supports SAML and time-based, one-time passwords.
How the community answered
(61 responses)- A5% (3)
- B8% (5)
- C3% (2)
- D84% (51)
Why each option
An IdP using SAML federation provides single sign-on to improve accessibility across all SaaS apps, while TOTP adds a second authentication factor that the apps do not natively support.
A password manager helps users store and retrieve credentials but does not implement two-factor authentication or federated SSO, leaving the underlying security gap unaddressed.
A VPN tunnel secures transit between on-premises and cloud infrastructure but does not add authentication factors, provide SSO, or change how users authenticate to SaaS applications.
Migrating away from SaaS and deploying applications internally is operationally disruptive and expensive, and directly contradicts the goal of securing and improving accessibility within the existing SaaS environment.
A SAML-based IdP federates identity across all cloud SaaS applications through SSO, eliminating separate credentials per app and improving accessibility, while the integrated TOTP service enforces time-based one-time password authentication at the IdP layer - delivering MFA even when individual SaaS vendors do not offer it natively.
Concept tested: IdP with SAML SSO and TOTP for SaaS MFA
Source: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks
Topics
Community Discussion
No community discussion yet for this question.