SY0-701 Question 240
Single answerPlatform diversity: Multi-cloud systemsA company hosts its customer portal across two cloud providers to reduce the risk of a single-provider outage. The security team discovers that administrators have separate accounts in each cloud, inconsistent MFA enforcement, and no centralized visibility into privileged activity. The company wants to reduce the chance of account compromise and improve monitoring without redesigning the applications. Which solution BEST addresses these requirements in a multi-cloud environment?
- A
Implement a centralized identity provider with federation and enforce MFA and role-based access across both cloud platforms
- B
Deploy identical host-based firewalls on all virtual machines in both clouds and manage rules locally on each instance
- C
Create separate administrator accounts for each cloud provider and rotate passwords more frequently
- D
Move all workloads into a single cloud provider so native logging and identity tools are easier to manage
Show answer and explanation
Correct answer: A
Explanation
The best answer is to centralize identity and access management across the multi-cloud environment. In real-world multi-cloud deployments, one of the most common security issues is inconsistent IAM configuration across providers. Security best practices from major cloud vendors and general security frameworks emphasize federated identity, centralized MFA enforcement, role-based access control, least privilege, and centralized logging/monitoring for administrative actions. This approach reduces credential sprawl, improves auditability, and supports consistent policy enforcement across heterogeneous platforms. By contrast, workload-level controls like host firewalls are useful but do not solve identity governance problems, and moving to a single provider would undermine the resilience objective of a multi-cloud strategy.
- A. Correct.
Correct. In a multi-cloud environment, a centralized identity provider using federation (such as SAML or OIDC where supported) helps standardize authentication and authorization across providers. Enforcing MFA centrally and using role-based access control reduces the attack surface created by separate privileged accounts and inconsistent policies. This also improves accountability and monitoring by tying administrative actions back to a common identity source. This is a practical security control that addresses identity sprawl without requiring application redesign.
- B. Incorrect.
Incorrect. Host-based firewalls can improve workload security, but they do not solve the core problems described: fragmented administrator identities, inconsistent MFA, and lack of centralized privileged activity visibility. Managing local rules separately on each instance may actually increase operational inconsistency in a multi-cloud deployment.
- C. Incorrect.
Incorrect. More frequent password rotation for separate administrator accounts does not address the underlying issue of identity fragmentation. It can also increase administrative burden and encourage weaker operational practices, such as password reuse or insecure storage. The stronger approach is centralized identity, federation, MFA, and least-privilege role assignment.
- D. Incorrect.
Incorrect. Consolidating to a single provider could reduce complexity, but it conflicts with the company's stated goal of using two cloud providers to reduce single-provider outage risk. It also represents a major architectural change, while the scenario specifically asks for a solution that improves security and monitoring without redesigning the applications.