CCSP · Question #22
You work for a government research facility. Your organization often shares data with other government research organizations. You would like to create a single sign-on experience across the…
The correct answer is A. Third-party identity broker. To achieve single sign-on and inter-organizational access without cross-certification, an identity broker can facilitate trust between disparate identity providers.
Question
You work for a government research facility. Your organization often shares data with other government research organizations. You would like to create a single sign-on experience across the organizations, where users at each organization can sign in with the user ID/authentication issued by that organization, then access research data in all the other organizations. Instead of replicating the data stores of each organization at every other organization (which is one way of accomplishing this goal), you instead want every user to have access to each organization's specific storage resources. If you don't use cross-certification, what other model can you implement for this purpose?
Options
- AThird-party identity broker
- BCloud reseller
- CIntractable nuanced variance
- DMandatory access control (MAC)
How the community answered
(32 responses)- A81% (26)
- B3% (1)
- C9% (3)
- D6% (2)
Why each option
To achieve single sign-on and inter-organizational access without cross-certification, an identity broker can facilitate trust between disparate identity providers.
A third-party identity broker acts as a trusted intermediary, allowing users from one organization to authenticate with their own identity provider and then access resources in other organizations within the federated trust circle. This model enables seamless single sign-on by translating identity assertions between different identity systems without requiring each organization to directly trust every other organization's identity provider.
A cloud reseller is an organization that sells cloud services to customers, not a mechanism for federated identity management.
"Intractable nuanced variance" is not a recognized IT or security concept or model.
Mandatory Access Control (MAC) is an access control model that restricts object access based on security labels, not a solution for federated single sign-on across multiple organizations.
Concept tested: Federated identity management and identity brokers
Source: https://learn.microsoft.com/en-us/azure/architecture/guide/identity/federated-identity
Topics
Community Discussion
No community discussion yet for this question.