Task 1.2: Define identity concepts

• AAn access token, then an ID token

  Incorrect

  The order is reversed: the access token is the one that grants access to the API.

• BAn ID token for both, since it also carries the user's group memberships

  Incorrect

  An ID token proves sign-in; permission to call an API on the user's behalf comes in an access token.

• CAn access token for both, since an access token also proves that the user signed in

  Incorrect

  An access token grants permission to a resource; the proof of sign-in the app reads is the ID token.

• DAn ID token, followed by an access token

  Correct

  The ID token is proof of sign-in and identifies the user; the access token grants the app permission to a resource on the user's behalf.

Identity providers issue security tokens that carry claims. The ID token proves that the user signed in (authentication) and tells the app who the user is. The access token gives the app permission to access a specific resource, such as an API, on behalf of the user (authorization). Both are time-limited.

• AAdministration

  Incorrect

  Administration covers creating, updating and removing identities and the policies that govern them.

• BAuditing

  Correct

  Auditing is tracking and recording who did what, when and from where, with sign-in logs, reports, alerts and forensic investigation.

• CAuthentication

  Incorrect

  Authentication verifies that an identity is who or what it claims to be.

• DAuthorization

  Incorrect

  Authorization decides what an authenticated identity is allowed to do.

An identity infrastructure rests on four pillars: administration, authentication, authorization and auditing. Auditing covers sign-in logs, activity reports, alerts on anomalous behavior and forensic investigation, which support compliance, incident detection and scoping a breach.

• ANothing more: Contoso's trust already works in both directions

  Incorrect

  Trust relationships aren't automatically bidirectional; a two-way trust must be configured explicitly.

• BFabrikam creates a Fabrikam account for each Contoso employee who needs the app

  Incorrect

  Federation exists so that users don't need a separate account in the other organization.

• CFabrikam configures its own identity provider to trust Contoso's in turn

  Correct

  If A trusts B, B doesn't automatically trust A, so Fabrikam must set up its own trust of Contoso's identity provider.

• DContoso synchronizes its users into Fabrikam's directory with a sync tool

  Incorrect

  Copying accounts into Fabrikam's directory isn't how federation works; it relies on trust.

Federation establishes trust between separate identity providers so that users sign in with credentials they already have. Trust isn't automatically bidirectional: if Organization A trusts Organization B, B doesn't trust A until it configures that trust itself.

• ABecause firewalls and VPN gateways at the perimeter no longer work

  Incorrect

  Firewalls still work; the problem is that much of the access no longer passes through them.

• BBecause identities can't be compromised

  Incorrect

  Identities can be compromised, which is exactly why verifying them matters so much.

• CBecause regulations forbid network-based controls

  Incorrect

  No regulation forbids network controls; they remain part of a layered defense.

• DBecause cloud apps, remote work and personal devices put much of the access outside the old perimeter

  Correct

  When trusted users and unmanaged devices connect from outside the boundary, the perimeter alone stops being a reliable control.

The traditional perimeter assumed that what mattered was inside the corporate network. Cloud and SaaS apps, remote and hybrid work, personal devices, partner and customer access and IoT devices have eroded it, so every access decision now starts with verifying the identity making the request, whether a person, a device or software.

• ARemove her account from each app's own user database

  Incorrect

  With SSO the apps rely on the identity provider, so per-app accounts aren't the control point.

• BDisable her account in the identity provider

  Correct

  Disabling the account in the identity provider immediately removes access to all connected applications.

• CReset her password and wait for each app's session to end

  Incorrect

  Resetting a password leaves the account usable for anyone who obtains the new one.

• DDelete the security tokens that the identity provider stored on her laptop

  Incorrect

  The identity provider would keep issuing new tokens while the account stays enabled.

A central identity provider enables single sign-on across every app that relies on it. It also centralizes control, so disabling a user account in the identity provider removes the user's access to all connected applications at once, which makes offboarding faster and more reliable.

• AKerberos with Active Directory

  Incorrect

  Kerberos is an Active Directory authentication protocol, and it isn't built on OAuth 2.0.

• BOpenID Connect

  Correct

  OpenID Connect verifies the user's identity and provides basic profile information, and it's built on OAuth 2.0.

• CSAML

  Incorrect

  SAML is commonly used in enterprise scenarios, for older applications and for federation between organizations.

• DNTLM

  Incorrect

  NTLM is an older Active Directory authentication protocol, and it isn't built on OAuth 2.0.

Identity providers and applications exchange requests and tokens with standard protocols. OpenID Connect is widely used for authentication in modern cloud and mobile apps and is built on top of OAuth 2.0, which is used for authorization. SAML is common in enterprise scenarios and with on-premises identity systems.

• ASomething you know

  Incorrect

  Something you know is a password, PIN or security question.

• BSomething you have

  Incorrect

  Something you have is a mobile device, hardware security key or smart card.

• CSomething you are

  Correct

  Biometrics such as a fingerprint or facial scan are something you are.

• DSomething you do

  Incorrect

  The three factor categories are know, have and are; there's no do category.

Authentication factors fall into three categories: something you know (password, PIN, security question), something you have (mobile device, hardware key, smart card) and something you are (fingerprint, facial scan). Multifactor authentication requires factors from two or more different categories.