Question 230 A multinational company uses a workforce IdP but contractors retain access after departure. What should be integrated? Validate issuer, audience, signature, recipient and validity conditions before issuing a session Validate issuer, signature, audience and token lifecycle using the configured trust relationship Map vetted claims and entitlements to local roles under explicit relying-party policy Synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications Explanation Correct Answer D:Federated login does not itself remove authorization or invalidate all existing sessions. Incorrect Answers A:This option fits a different fact pattern where a SAML relying party accepts assertions intended for another application: signed assertions must be intended for the current relying party and within permitted time bounds; the current case instead requires synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications. B:This option fits a different fact pattern where an application accepts unsigned OpenID Connect ID-token data from a browser: token payload fields are not trustworthy until cryptographic and contextual validation succeeds; the current case instead requires synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications. C:This option fits a different fact pattern where a service treats every external identity's group name 'admin' as local administrator: external attribute text must not automatically become internal privilege; the current case instead requires synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications.
Question 231 A service treats every external identity's group name 'admin' as local administrator. What should be corrected? Establish trusted identity federation with bounded application claims and access policy Validate issuer, signature, audience and token lifecycle using the configured trust relationship Map vetted claims and entitlements to local roles under explicit relying-party policy Validate issuer, audience, signature, recipient and validity conditions before issuing a session Explanation Correct Answer C:External attribute text must not automatically become internal privilege. Incorrect Answers A:Federation delegates authentication while the relying service still enforces its own permissions; although this helps when a partner's employees need one SaaS app but the customer does not want to create local passwords, it leaves the current case's need to map vetted claims and entitlements to local roles under explicit relying-party policy unresolved. B:This option fits a different fact pattern where an application accepts unsigned OpenID Connect ID-token data from a browser: token payload fields are not trustworthy until cryptographic and contextual validation succeeds; the current case instead requires map vetted claims and entitlements to local roles under explicit relying-party policy. D:Signed assertions must be intended for the current relying party and within permitted time bounds; this responds to the different circumstance in which a SAML relying party accepts assertions intended for another application, while the current case states that a service treats every external identity's group name 'admin' as local administrator, calling for map vetted claims and entitlements to local roles under explicit relying-party policy.
Question 232 A hybrid app loses access when its only identity provider's region fails. What resilience issue needs review? Establish trusted identity federation with bounded application claims and access policy Design and test recovery for federation dependencies and session continuity Synchronize contractor lifecycle events and enforce account/session deprovisioning across federated applications Map vetted claims and entitlements to local roles under explicit relying-party policy Explanation Correct Answer B:Identity infrastructure is a critical service dependency and can cause wide outages. Incorrect Answers A:The other scenario states that a partner's employees need one SaaS app but the customer does not want to create local passwords, where federation delegates authentication while the relying service still enforces its own permissions; by contrast, the present case requires design and test recovery for federation dependencies and session continuity. C:Federated login does not itself remove authorization or invalidate all existing sessions; it is relevant where a multinational company uses a workforce IdP but contractors retain access after departure, whereas the current facts require design and test recovery for federation dependencies and session continuity to address the stated problem. D:External attribute text must not automatically become internal privilege; it is relevant where a service treats every external identity's group name 'admin' as local administrator, whereas the current facts require design and test recovery for federation dependencies and session continuity to address the stated problem.
Question 233 An application accepts unsigned OpenID Connect ID-token data from a browser. What must the relying party enforce? Trust the browser-provided token claims because the website itself is served over HTTPS Check the user name in the token payload but skip cryptographic signature verification Validate issuer, signature, audience and token lifecycle using the configured trust relationship Base64-decode the ID token and accept its audience field without verifying the signature Explanation Correct Answer C:Token payload fields are not trustworthy until cryptographic and contextual validation succeeds. Incorrect Answers A:TLS protects the connection but does not prove that a browser-supplied ID token was signed by the intended issuer or names this relying party. B:An attacker can modify unverified token claims, so matching a username does not establish token authenticity. D:Encoding is not authenticity; an unsigned or tampered token must not create an authenticated application session.
Question 234 A bank grants privileges by job functions such as teller and approver. Which authorization model is most appropriate? Use role-based access control with approved role definitions and separation of duties Include contextual risk signals in policy decisions while preserving auditable rule governance Enforce time-conditional authorization and disable access outside the approved window Implement mandatory access controls with centrally governed security labels Explanation Correct Answer A:RBAC maps entitlements to business roles rather than to arbitrary individual exceptions. Incorrect Answers B:Risk-adaptive access may change based on current transaction or actor risk; this responds to the different circumstance in which a payment system denies approval when the operator's fraud-risk score exceeds a threshold, while the current case states that a bank grants privileges by job functions such as teller and approver, calling for use role-based access control with approved role definitions and separation of duties. C:The other scenario states that a system's nightly batch job requires access only between 02:00 and 03:00, where environmental and scheduling constraints can make static 24-hour roles unnecessarily broad; by contrast, the present case requires use role-based access control with approved role definitions and separation of duties. D:MAC decisions are driven by system-enforced classifications and clearances; although this helps when a laboratory must restrict a document by both employee clearance and classified label, it leaves the current case's need to use role-based access control with approved role definitions and separation of duties unresolved.
Question 235 A laboratory must restrict a document by both employee clearance and classified label. Which model fits? Enforce verified region and resource attributes at each protected API operation Implement mandatory access controls with centrally governed security labels Keep policy decision logic separate from a policy enforcement point that actually blocks disallowed actions Separate administration of authorization policy from high-risk business transactions Explanation Correct Answer B:MAC decisions are driven by system-enforced classifications and clearances. Incorrect Answers A:Policy text has no protective effect unless its conditions are evaluated during access; it is relevant where a policy permits a contractor to view records only in their assigned region but the API never checks region claims, whereas the current facts require implement mandatory access controls with centrally governed security labels to address the stated problem. C:For the separate situation in which a network gateway decides whether to permit a request, but the application ignores the decision, a decision point cannot protect resources unless its verdict is consistently enforced; here the stated problem requires implement mandatory access controls with centrally governed security labels. D:Segregation prevents one principal from self-authorizing sensitive actions; it is relevant where an employee can change both the approval rule and the corresponding payment record, whereas the current facts require implement mandatory access controls with centrally governed security labels to address the stated problem.
Question 236 A project shares reports with a collaborator only when the resource owner authorizes that person. Which control pattern is being used? Use discretionary access decisions by the resource owner within overarching policy Separate administration of authorization policy from high-risk business transactions Include contextual risk signals in policy decisions while preserving auditable rule governance Scope actions and resources to the minimum permissions required for the approved task Explanation Correct Answer A:DAC allows delegated owner-driven permissions, subject to higher-level restrictions. Incorrect Answers B:For the separate situation in which an employee can change both the approval rule and the corresponding payment record, segregation prevents one principal from self-authorizing sensitive actions; here the stated problem requires use discretionary access decisions by the resource owner within overarching policy. C:The other scenario states that a payment system denies approval when the operator's fraud-risk score exceeds a threshold, where risk-adaptive access may change based on current transaction or actor risk; by contrast, the present case requires use discretionary access decisions by the resource owner within overarching policy. D:This option fits a different fact pattern where a technician is granted every filesystem permission because a single command requires write access: least privilege applies at operation and resource granularity, not only account membership; the current case instead requires use discretionary access decisions by the resource owner within overarching policy.
Question 237 A multinational wants access based on department, project, record sensitivity and region in one decision. What strategy fits? Include contextual risk signals in policy decisions while preserving auditable rule governance Enforce verified region and resource attributes at each protected API operation Apply attribute-based access control with trustworthy subject, object and environment attributes Use discretionary access decisions by the resource owner within overarching policy Explanation Correct Answer C:ABAC evaluates policy predicates beyond one static role label. Incorrect Answers A:The other scenario states that a payment system denies approval when the operator's fraud-risk score exceeds a threshold, where risk-adaptive access may change based on current transaction or actor risk; by contrast, the present case requires apply attribute-based access control with trustworthy subject, object and environment attributes. B:Policy text has no protective effect unless its conditions are evaluated during access; this responds to the different circumstance in which a policy permits a contractor to view records only in their assigned region but the API never checks region claims, while the current case states that a multinational wants access based on department, project, record sensitivity and region in one decision, calling for apply attribute-based access control with trustworthy subject, object and environment attributes. D:DAC allows delegated owner-driven permissions, subject to higher-level restrictions; this responds to the different circumstance in which a project shares reports with a collaborator only when the resource owner authorizes that person, while the current case states that a multinational wants access based on department, project, record sensitivity and region in one decision, calling for apply attribute-based access control with trustworthy subject, object and environment attributes.
Question 238 A payment system denies approval when the operator's fraud-risk score exceeds a threshold. Which authorization approach is used? Enforce time-conditional authorization and disable access outside the approved window Separate administration of authorization policy from high-risk business transactions Enforce verified region and resource attributes at each protected API operation Include contextual risk signals in policy decisions while preserving auditable rule governance Explanation Correct Answer D:Risk-adaptive access may change based on current transaction or actor risk. Incorrect Answers A:Environmental and scheduling constraints can make static 24-hour roles unnecessarily broad; although this helps when a system's nightly batch job requires access only between 02:00 and 03:00, it leaves the current case's need to include contextual risk signals in policy decisions while preserving auditable rule governance unresolved. B:Segregation prevents one principal from self-authorizing sensitive actions; although this helps when an employee can change both the approval rule and the corresponding payment record, it leaves the current case's need to include contextual risk signals in policy decisions while preserving auditable rule governance unresolved. C:This option fits a different fact pattern where a policy permits a contractor to view records only in their assigned region but the API never checks region claims: policy text has no protective effect unless its conditions are evaluated during access; the current case instead requires include contextual risk signals in policy decisions while preserving auditable rule governance.
Question 239 A network gateway decides whether to permit a request, but the application ignores the decision. Which enforcement split is missing? Enforce time-conditional authorization and disable access outside the approved window Enforce verified region and resource attributes at each protected API operation Apply attribute-based access control with trustworthy subject, object and environment attributes Keep policy decision logic separate from a policy enforcement point that actually blocks disallowed actions Explanation Correct Answer D:A decision point cannot protect resources unless its verdict is consistently enforced. Incorrect Answers A:This option fits a different fact pattern where a system's nightly batch job requires access only between 02:00 and 03:00: environmental and scheduling constraints can make static 24-hour roles unnecessarily broad; the current case instead requires keep policy decision logic separate from a policy enforcement point that actually blocks disallowed actions. B:Policy text has no protective effect unless its conditions are evaluated during access; although this helps when a policy permits a contractor to view records only in their assigned region but the API never checks region claims, it leaves the current case's need to keep policy decision logic separate from a policy enforcement point that actually blocks disallowed actions unresolved. C:For the separate situation in which a multinational wants access based on department, project, record sensitivity and region in one decision, aBAC evaluates policy predicates beyond one static role label; here the stated problem requires keep policy decision logic separate from a policy enforcement point that actually blocks disallowed actions.
Question 240 An employee can change both the approval rule and the corresponding payment record. What should authorization design do? Apply attribute-based access control with trustworthy subject, object and environment attributes Implement mandatory access controls with centrally governed security labels Separate administration of authorization policy from high-risk business transactions Use role-based access control with approved role definitions and separation of duties Explanation Correct Answer C:Segregation prevents one principal from self-authorizing sensitive actions. Incorrect Answers A:For the separate situation in which a multinational wants access based on department, project, record sensitivity and region in one decision, aBAC evaluates policy predicates beyond one static role label; here the stated problem requires separate administration of authorization policy from high-risk business transactions. B:This option fits a different fact pattern where a laboratory must restrict a document by both employee clearance and classified label: mAC decisions are driven by system-enforced classifications and clearances; the current case instead requires separate administration of authorization policy from high-risk business transactions. D:The other scenario states that a bank grants privileges by job functions such as teller and approver, where rBAC maps entitlements to business roles rather than to arbitrary individual exceptions; by contrast, the present case requires separate administration of authorization policy from high-risk business transactions.
