[Identity and Access Management (IAM)] A cloud engineer needs to identify appropriate solutions to: • Provide secure access to internal and external cloud resources. • Eliminate split-tunnel traffic flows. •Enable identity and access management capabilities. Which of the following solutions arc the most appropriate? (Select two).

A Secure Access Service Edge (SASE) architecture is the most comprehensive solution as it converges networking and security services into a single, cloud-delivered platform. SASE is explicitly designed to provide secure, identity-driven access to both internal and external resources from any location. A core tenet of SASE is to inspect all traffic by routing it through a cloud security stack, which directly addresses the requirement to eliminate split-tunneling. A Cloud Access Security Broker (CASB) is a critical security component, often integrated within a SASE framework. It acts as a policy enforcement point between users and cloud services, providing visibility, data security, and threat protection. It directly enables secure access to cloud resources and integrates with identity and access management (IAM) systems to enforce granular policies.

A. Federation: An IAM method for linking identities across different security domains; it does not manage or route network traffic to eliminate split-tunneling.
B. Microsegmentation: A security technique for isolating workloads within a data center or cloud environment, not for managing remote user access traffic flows.
D. PAM: A solution focused on controlling, monitoring, and securing access for privileged accounts, not for general user traffic or network architecture.
E. SD-WAN: A network technology that optimizes WAN traffic. On its own, it lacks integrated security services and is often used to enable split-tunneling, not eliminate it.

1. National Institute of Standards and Technology (NIST) Special Publication 800-207

"Zero Trust Architecture": Section 6.2

"Resource Portal/Gateway

" describes how components like a CASB and SASE function as Policy Enforcement Points (PEPs). It states

"SASE combines SD-WAN capabilities with cloud-native security functions... to provide a single

holistic

cloud-based service for enterprise access." This supports SASE's role in unifying access and security.

2. National Institute of Standards and Technology (NIST)

"Trusted Internet Connections (TIC) 3.0: Core Guidance Volume 1: Program Guidebook": Section 4.2

"TIC 3.0 Use Cases

" discusses modernizing network security by moving away from traditional perimeter models. It describes scenarios where remote users connect through cloud-native security services

aligning with the SASE model of eliminating backhauled or split-tunneled traffic in favor of a distributed inspection model.

3. Al-Marridi

A. Z.

et al. (2022). "A SASE-based Security Architecture for the Internet of Vehicles." IEEE Transactions on Intelligent Transportation Systems

23(11)

22011-22022. (DOI: 10.1109/TITS.2022.3142539): This peer-reviewed article defines SASE as a "cloud-native security architecture that converges network and network security services" and notes that it allows organizations to "apply identity and context to specify the exact level of performance

reliability

[and] security... for every network session

" highlighting its integrated IAM capabilities.