CV0-004 Practice Question: Which THREE of the following are valid methods to…

Correct answer & explanation

Option B is correct because SAML 2.0 federation lets the corporate identity provider act as the authoritative IdP, issuing signed assertions that each cloud provider's STS trusts, enabling single sign-on and centralized identity lifecycle management across clouds. Option C is correct because tagging resources and referencing those tags in ABAC policies allows a single, consistent authorization model (for example, 'allow if resource tag owner == user.department') to be evaluated across heterogeneous cloud IAM engines. Option E is correct because a CASB sits between users and multiple cloud services to enforce authentication, authorization, DLP, and shadow-IT policies uniformly, which is a recognized way to govern access in multi-cloud environments. Option A is not an identity or access management method; a site-to-site VPN only provides encrypted network connectivity between on-premises and cloud networks. Option D is not valid because a single shared API key is a static, non-attributable credential that cannot be scoped per user or cloud, breaks least privilege and auditability, and is an anti-pattern for identity management.