mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A multinational corporation is deploying a new…
A multinational corporation is deploying a new application that will be accessed by employees, partners, and customers. The security architecture must support single sign-on (SSO) across different identity providers (IdPs) while maintaining strict access control based on user attributes such as role, location, and device posture. The company uses Active Directory for employees, a cloud IdP for partners, and self-registration for customers. The architect needs to design a centralized policy enforcement point that can evaluate access requests from multiple IdPs and enforce dynamic access policies before granting access to the application.
Which of the following is the BEST architectural approach?
⚠ Common exam trap
The CAS-004 exam often tests the misconception that a federation server or reverse proxy alone can handle dynamic authorization, when in fact they only handle authentication and identity propagation, not the centralized, attribute-based policy evaluation required for strict access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement an externalized authorization management system (e.g., OAuth 2.0 with OpenID Connect) using a policy decision point (PDP) and a policy enforcement point (PEP) at the application gateway
It uses an externalized authorization management system with a Policy Decision Point (PDP) and Policy Enforcement Point (PEP) at the application gateway, which decouples authentication from authorization. This architecture allows centralized, attribute-based access control (ABAC) across multiple IdPs (Active Directory, cloud IdP, self-registration) while supporting SSO via OAuth 2.0 and OpenID Connect. The PDP evaluates dynamic policies based on user attributes (role, location, device posture) and the PEP enforces the decision before granting access, meeting the requirement for strict, context-aware access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a SAML/WS-Federation federation server that authenticates users and then passes the identity to the application for authorization
Why it's wrong here
The federation server handles authentication but the application must still implement authorization logic; no centralized policy enforcement.
- ✗
Have each IdP enforce its own access policies and pass the authorization decision via SAML assertions
Why it's wrong here
This leads to inconsistent policies and does not provide a centralized view.
- ✗
Configure a reverse proxy to authenticate users from any IdP and pass their identity to the application
Why it's wrong here
A reverse proxy can handle authentication but not fine-grained attribute-based authorization.
- ✓
Implement an externalized authorization management system (e.g., OAuth 2.0 with OpenID Connect) using a policy decision point (PDP) and a policy enforcement point (PEP) at the application gateway
Why this is correct
This separates authentication from authorization, allows centralized attribute-based policy, and works across IdPs.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.