hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Uses a multi-cloud strategy with workloads in AWS…
An organization uses a multi-cloud strategy with workloads in AWS and Azure. The security architect needs to implement a single identity provider for all cloud resources while maintaining on-premises Active Directory as the authoritative source. Which architecture minimizes latency and complexity?
⚠ Common exam trap
Candidates often assume Azure AD must be the identity source for AWS because of Microsoft's ecosystem, but direct federation with ADFS avoids the latency and complexity of intermediate synchronization while still using on-premises AD as the authoritative source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Federate on-premises AD directly with both AWS and Azure using ADFS
Federating on-premises Active Directory directly with both AWS and Azure using ADFS (Active Directory Federation Services) minimizes latency and complexity by avoiding intermediate synchronization steps. ADFS acts as a single identity provider that issues SAML 2.0 assertions to both cloud providers, allowing users to authenticate against on-premises AD in real time without replicating identity data to the cloud. This eliminates the need for directory synchronization, reducing both architectural overhead and authentication latency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a third-party cloud-based identity provider and sync AD to it
Why it's wrong here
A third-party IdP adds cost and complexity without clear benefit over direct federation.
- ✗
Synchronize AD to Azure AD and then use Azure AD as an identity source for AWS via SAML
Why it's wrong here
Synchronising AD to Microsoft Entra ID and using it as a SAML identity source for AWS introduces additional latency because every authentication request from AWS must traverse the internet to Microsoft Entra ID, rather than using a local on-premises federation server. This option is tempting because Microsoft Entra ID is the natural cloud extension of on-premises AD for Microsoft-centric environments, and it would be correct if the organisation had no requirement to minimise latency and could tolerate internet-dependent authentication for AWS workloads.
- ✗
Create separate identity stores in AWS and Azure and sync from AD
Why it's wrong here
Separate stores increase management overhead and inconsistency.
- ✓
Federate on-premises AD directly with both AWS and Azure using ADFS
Why this is correct
ADFS can federate with both clouds using SAML, minimizing synchronization and complexity.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.