A shared sign-in does not widen the first scope | Rapid course Security governance, risk and compliance

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 18. Map, example, EX072.

flowchart TD
  I["Identity provider supports all three services"] --> R["It joins the appointment restore"]
  R --> S["First scope still excludes case management and the roster"]
  S --> N["Do not open those services because sign-in is shared"]

One component can enter an exercise while the other services stay outside the page.

Logical drawing

why identity joins the restore
    without sign-in a restored portal still cannot reopen
first scope
    portal, scheduling database, identity provider, backup service
still excluded
    case management
    volunteer roster
        |
        +-- reconnecting identity is not a case-note review
        +-- the case database stays closed
        +-- the roster spreadsheet stays unedited

Learning outcomes

After this chapter, you should be able to:

Explain why the identity provider is inside the restore.
Keep that reason from pulling case management or the roster into scope.
Leave the case database closed and the roster unedited.

18.1 Shared support explains the exercise. It does not rewrite the inclusion list.

The listing shows the identity provider shared by all three services, which is why a restore of the portal includes reconnecting it: staff who cannot sign in still cannot reopen appointments. A classmate treats that shared support as a new scope. If identity is in the exercise, they argue, case notes and the volunteer roster are in it too, because both depend on the same sign-in. The first scope still names the appointment portal, the scheduling database, the identity provider and the backup service. Case management and the roster remain excluded until next quarter. Reconnecting identity during the portal exercise is not permission to read case notes. The engineer leaves the case database closed and does not edit the roster spreadsheet.

18.2 Worked example

Lesson table; scroll horizontally to read all columns →

Leap	Fact it starts from	Decision
Identity joins the appointment restore	Support of all three, and sign-in is required to reopen	Accept that narrow addition
"Then open case management."	The same shared row	Refuse
"Then review the roster while we are signed in."	The same shared row	Refuse
Delete the case-database row so the question goes away	The listing's purpose	Refuse

Synthetic case. No case note is read. The shared line stays shared by all three: ['identity provider'].

Errors and limits

Keeping the other services out does not hide the dependency. The row stays in the listing so the dependency can be seen without being investigated.

Apply

EX072 — What did the shared row authorise? The identity provider supports all three services and was reconnected during the appointment restore. A teammate opens case management and the roster because they use the same sign-in. What addition was justified, and what stays excluded?
Show marking criteria
Rubric: 3 = identity joins the portal restore because sign-in is required to reopen it; case management and the roster stay excluded; do not open the case database; do not edit the roster;; 2 = shared sign-in is not a wider scope;; 1 = one of those;; 0 = none.