What is the primary purpose of federation in cloud identity management?

• A. To enable single sign-on across trusted domains
• B. To require MFA for every user
• C. To centralize encryption keys
• D. To enforce password history

Answer: (A)

Federation focuses on establishing trust between different security domains so a user authenticated in one domain can access services in another without re-entering credentials. The main payoff is single sign-on across trusted domains: after you sign in with your organization's identity provider, you receive a token (like a SAML assertion or an OpenID Connect ID token) that the service provider in another domain accepts, allowing seamless access. This keeps passwords and authentication centralized with the IdP while enabling access to multiple cloud apps or services.

MFA for every user, centralized encryption keys, and enforcing password history are separate controls or policies. MFA is an authentication step, not the interoperability mechanism federation provides. Centralizing encryption keys deals with cryptographic key management, not cross-domain identity authentication. Enforcing password history is a password policy, not about enabling cross-domain access through trusted authentication.