問題文
A team must decide how to give a partner organization's employees access to a database it operates. What does the guidance compare, and what does it favor?
選択肢
- The partner's employees should be issued enterprise devices, since only a managed asset can be evaluated for posture, and an unmanaged laptop therefore fails the evaluation that the operating organization performs.
- Specialized accounts are preferred, since a federated identity cannot be evaluated against the operating organization's own policy, and the organization that runs the database therefore has to hold an account of its own for each of the partner's employees.
- Setting up specialized accounts for the partner's employees can quickly become difficult to manage, whereas having both organizations enrolled in a federated identity management system would allow quicker establishment of the relationships, provided both enforcement points can authenticate subjects in that community.
- Complex firewall rules or enterprise-wide access control lists allowing the partner's addresses should be created, because the operating organization's policies have to be expressed in terms the partner's network can satisfy and address-based rules are the only common vocabulary between two domains.