Question 220 A business unit deploys shared password vault credentials for all shift operators. What identity issue results? Keep the single shared operator identity but rotate its password at every shift change Require MFA only for the shared vault account and continue executing actions as the same shared operator Replace shared access with named identities and controlled privileged-session delegation Record the common account name for every administrative event without identifying the human operator Explanation Correct Answer C:Unique identities preserve accountability even when access to a shared system is operationally necessary. Incorrect Answers A:Rotation reduces exposure time but still cannot attribute privileged actions to a particular operator under a shared identity. B:Vault MFA improves the initial login but does not necessarily provide named downstream action attribution; delegated individual sessions are needed. D:A log of one generic principal does not distinguish which person performed an action, undermining accountability and investigation.
Question 221 A customer portal presents successful login but sessions never expire after inactivity. What should session design implement? Perform identity proofing appropriate to privilege before issuing authenticators Apply risk-based session lifetime, idle timeout and token invalidation controls Adopt appropriately bound FIDO2 passkeys or comparable phishing-resistant authenticators Replace shared access with named identities and controlled privileged-session delegation Explanation Correct Answer B:Authentication must be followed by secure session lifecycle management. Incorrect Answers A:Authentication strength cannot compensate for fraudulent initial identity enrollment; although this helps when an enrollment desk activates new privileged accounts using only a caller-provided email address, it leaves the current case's need to apply risk-based session lifetime, idle timeout and token invalidation controls unresolved. C:Origin-bound public-key authenticators reduce credential replay at impostor websites; it is relevant where a company wants phishing-resistant login to administrative consoles where phishing is common, whereas the current facts require apply risk-based session lifetime, idle timeout and token invalidation controls to address the stated problem. D:For the separate situation in which a business unit deploys shared password vault credentials for all shift operators, unique identities preserve accountability even when access to a shared system is operationally necessary; here the stated problem requires apply risk-based session lifetime, idle timeout and token invalidation controls.
Question 222 A global workforce has five separate passwords for the same company applications. What identity strategy reduces duplication? Secure authenticator recovery and enrollment to assurance levels appropriate to accounts Replace shared access with named identities and controlled privileged-session delegation Use properly scoped federation or short-lived delegated credentials instead of duplicated passwords Centralize enterprise authentication using a supported single sign-on identity provider Explanation Correct Answer D:SSO reduces repeated credential handling while still requiring strong IdP protection. Incorrect Answers A:Weak recovery channels can bypass strong primary authentication; this responds to the different circumstance in which an organization adopts MFA but allows email reset with no comparable verification, while the current case states that a global workforce has five separate passwords for the same company applications, calling for centralize enterprise authentication using a supported single sign-on identity provider. B:Unique identities preserve accountability even when access to a shared system is operationally necessary; although this helps when a business unit deploys shared password vault credentials for all shift operators, it leaves the current case's need to centralize enterprise authentication using a supported single sign-on identity provider unresolved. C:Federation separates identity ownership from application authorization; it is relevant where a supplier wants to store its own passwords inside the customer's application for integration, whereas the current facts require centralize enterprise authentication using a supported single sign-on identity provider to address the stated problem.
Question 223 A supplier wants to store its own passwords inside the customer's application for integration. What is preferable? Centralize enterprise authentication using a supported single sign-on identity provider Use properly scoped federation or short-lived delegated credentials instead of duplicated passwords Require step-up authentication and transaction-specific authorization for high-risk operations Adopt appropriately bound FIDO2 passkeys or comparable phishing-resistant authenticators Explanation Correct Answer B:Federation delegates authentication to a trusted identity provider while short-lived delegated tokens avoid duplicating passwords in the customer application; the customer must still enforce narrow authorization. Incorrect Answers A:The other scenario states that a global workforce has five separate passwords for the same company applications, where sSO reduces repeated credential handling while still requiring strong IdP protection; by contrast, the present case requires use properly scoped federation or short-lived delegated credentials instead of duplicated passwords. C:This option fits a different fact pattern where a cloud administrator must approve a sensitive action even after normal sign-in: initial login assurance may be insufficient for later consequential actions; the current case instead requires use properly scoped federation or short-lived delegated credentials instead of duplicated passwords. D:This option fits a different fact pattern where a company wants phishing-resistant login to administrative consoles where phishing is common: origin-bound public-key authenticators reduce credential replay at impostor websites; the current case instead requires use properly scoped federation or short-lived delegated credentials instead of duplicated passwords.
Question 224 A privileged on-call engineer needs temporary administrative rights during incidents. What model fits? Secure authenticator recovery and enrollment to assurance levels appropriate to accounts Adopt appropriately bound FIDO2 passkeys or comparable phishing-resistant authenticators Grant just-in-time elevation through approval, expiry and auditable privileged access Perform identity proofing appropriate to privilege before issuing authenticators Explanation Correct Answer C:Temporary elevation reduces exposure relative to permanent privileged roles. Incorrect Answers A:The other scenario states that an organization adopts MFA but allows email reset with no comparable verification, where weak recovery channels can bypass strong primary authentication; by contrast, the present case requires grant just-in-time elevation through approval, expiry and auditable privileged access. B:For the separate situation in which a company wants phishing-resistant login to administrative consoles where phishing is common, origin-bound public-key authenticators reduce credential replay at impostor websites; here the stated problem requires grant just-in-time elevation through approval, expiry and auditable privileged access. D:This option fits a different fact pattern where an enrollment desk activates new privileged accounts using only a caller-provided email address: authentication strength cannot compensate for fraudulent initial identity enrollment; the current case instead requires grant just-in-time elevation through approval, expiry and auditable privileged access.
Question 225 An organization adopts MFA but allows email reset with no comparable verification. What should be addressed? Replace shared access with named identities and controlled privileged-session delegation Perform identity proofing appropriate to privilege before issuing authenticators Secure authenticator recovery and enrollment to assurance levels appropriate to accounts Require step-up authentication and transaction-specific authorization for high-risk operations Explanation Correct Answer C:Weak recovery channels can bypass strong primary authentication. Incorrect Answers A:This option fits a different fact pattern where a business unit deploys shared password vault credentials for all shift operators: unique identities preserve accountability even when access to a shared system is operationally necessary; the current case instead requires secure authenticator recovery and enrollment to assurance levels appropriate to accounts. B:Authentication strength cannot compensate for fraudulent initial identity enrollment; although this helps when an enrollment desk activates new privileged accounts using only a caller-provided email address, it leaves the current case's need to secure authenticator recovery and enrollment to assurance levels appropriate to accounts unresolved. D:For the separate situation in which a cloud administrator must approve a sensitive action even after normal sign-in, initial login assurance may be insufficient for later consequential actions; here the stated problem requires secure authenticator recovery and enrollment to assurance levels appropriate to accounts.
Question 226 A service certificate is deployed without recording who owns renewal. What identity governance is required? Replace shared access with named identities and controlled privileged-session delegation Apply risk-based session lifetime, idle timeout and token invalidation controls Assign lifecycle ownership for machine credentials with renewal, revocation and inventory Perform identity proofing appropriate to privilege before issuing authenticators Explanation Correct Answer C:Machine identities expire or become compromised just as human authenticators do. Incorrect Answers A:Unique identities preserve accountability even when access to a shared system is operationally necessary; this responds to the different circumstance in which a business unit deploys shared password vault credentials for all shift operators, while the current case states that a service certificate is deployed without recording who owns renewal, calling for assign lifecycle ownership for machine credentials with renewal, revocation and inventory. B:Authentication must be followed by secure session lifecycle management; it is relevant where a customer portal presents successful login but sessions never expire after inactivity, whereas the current facts require assign lifecycle ownership for machine credentials with renewal, revocation and inventory to address the stated problem. D:Authentication strength cannot compensate for fraudulent initial identity enrollment; this responds to the different circumstance in which an enrollment desk activates new privileged accounts using only a caller-provided email address, while the current case states that a service certificate is deployed without recording who owns renewal, calling for assign lifecycle ownership for machine credentials with renewal, revocation and inventory.
Question 227 A partner's employees need one SaaS app but the customer does not want to create local passwords. What is the best identity architecture? Use managed trust metadata and controlled certificate/key rollover validation Establish trusted identity federation with bounded application claims and access policy Validate issuer, audience, signature, recipient and validity conditions before issuing a session Synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications Explanation Correct Answer B:Federation delegates authentication while the relying service still enforces its own permissions. Incorrect Answers A:This option fits a different fact pattern where a federation provider rotates signing keys and the application continues trusting a retired key indefinitely: federation trust must evolve without making obsolete signing credentials permanent; the current case instead requires establish trusted identity federation with bounded application claims and access policy. C:The other scenario states that a SAML relying party accepts assertions intended for another application, where signed assertions must be intended for the current relying party and within permitted time bounds; by contrast, the present case requires establish trusted identity federation with bounded application claims and access policy. D:This option fits a different fact pattern where a multinational company uses a workforce IdP but contractors retain access after departure: federated login does not itself remove authorization or invalidate all existing sessions; the current case instead requires establish trusted identity federation with bounded application claims and access policy.
Question 228 A SAML relying party accepts assertions intended for another application. What should it verify? Accept any SAML assertion signed by a trusted provider without checking which relying-party audience it names Increase the assertion token validity period to prevent users from having to log in again Validate issuer, audience, signature, recipient and validity conditions before issuing a session Map all incoming groups to a broad local administrator role before reading the assertion recipient Explanation Correct Answer C:Signed assertions must be intended for the current relying party and within permitted time bounds. Incorrect Answers A:A valid signature does not make an assertion intended for another application acceptable; audience and recipient must also match this relying party. B:Longer lifetime does not prevent cross-application token acceptance and can increase replay exposure. D:Role mapping neither fixes audience checks nor limits the impact of accepting assertions intended for a different service.
Question 229 A federation provider rotates signing keys and the application continues trusting a retired key indefinitely. What should change? Establish trusted identity federation with bounded application claims and access policy Use managed trust metadata and controlled certificate/key rollover validation Map vetted claims and entitlements to local roles under explicit relying-party policy Design and test recovery for federation dependencies and session continuity Explanation Correct Answer B:Federation trust must evolve without making obsolete signing credentials permanent. Incorrect Answers A:For the separate situation in which a partner's employees need one SaaS app but the customer does not want to create local passwords, federation delegates authentication while the relying service still enforces its own permissions; here the stated problem requires use managed trust metadata and controlled certificate/key rollover validation. C:External attribute text must not automatically become internal privilege; this responds to the different circumstance in which a service treats every external identity's group name 'admin' as local administrator, while the current case states that a federation provider rotates signing keys and the application continues trusting a retired key indefinitely, calling for use managed trust metadata and controlled certificate/key rollover validation. D:For the separate situation in which a hybrid app loses access when its only identity provider's region fails, identity infrastructure is a critical service dependency and can cause wide outages; here the stated problem requires use managed trust metadata and controlled certificate/key rollover validation.
Question 230 A multinational company uses a workforce IdP but contractors retain access after departure. What should be integrated? Validate issuer, audience, signature, recipient and validity conditions before issuing a session Validate issuer, signature, audience and token lifecycle using the configured trust relationship Map vetted claims and entitlements to local roles under explicit relying-party policy Synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications Explanation Correct Answer D:Federated login does not itself remove authorization or invalidate all existing sessions. Incorrect Answers A:This option fits a different fact pattern where a SAML relying party accepts assertions intended for another application: signed assertions must be intended for the current relying party and within permitted time bounds; the current case instead requires synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications. B:This option fits a different fact pattern where an application accepts unsigned OpenID Connect ID-token data from a browser: token payload fields are not trustworthy until cryptographic and contextual validation succeeds; the current case instead requires synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications. C:This option fits a different fact pattern where a service treats every external identity's group name 'admin' as local administrator: external attribute text must not automatically become internal privilege; the current case instead requires synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications.
