A utilities operator has 1,200 staff in Active Directory whose groups drive authorization, 30 substation device accounts that live only in an OpenLDAP directory, and administrators who must enter an Authenticator-app code after their password. Both directories stay exactly as they are. Which identity store design satisfies all three requirements?
Select an answer to reveal the explanation.
Short Explanation
You’ll query Active Directory first and fall back to LDAP for substation accounts, like checking the right directory for each set of keys. Then forward administrators to an external RADIUS MFA server: another password store is just another copy of the same kind of key, while an app code adds a true factor.
Full Explanation
The correct design uses an identity-store sequence: Active Directory authenticates staff and supplies the group membership needed for authorization, while LDAP provides a lookup path for the device accounts that exist only there. Administrator authentication can then be forwarded to the external RADIUS MFA service so the password-based identity check is supplemented by the required Authenticator-app code, without changing either directory. Making RADIUS the administrators' primary authenticator is a recognized proxy pattern, but it does not necessarily chain the established directory password check with a second factor; it can replace that check, so it fails to preserve the intended AD-backed authentication and group context. Locally storing OTP secrets can be appropriate for identities managed inside an MFA-capable platform, but the ISE internal user store is not a substitute for an external RADIUS OTP service in this design; it also moves the administrator factor out of the specified MFA integration. LDAP can commonly supply authorization attributes when those attributes are actually maintained there, but these staff groups reside in AD, so LDAP cannot provide the required group-based staff authorization. Exam caveat: an identity-store sequence is not itself MFA; verify that the administrator policy invokes the MFA service after primary authentication rather than merely selecting RADIUS as another password store. Practical check: test a staff account with an AD group, a substation account found only in LDAP, and an administrator login with both a valid and invalid app code, confirming directory contents remain unchanged.