During a forensic investigation into a cyberattack that compromised a company’s sensitive data, the investigator...

As per theCHFI v11 Cloud Forensics objectives, cloud-based identity and access management solutions that provideSingle Sign-On (SSO),Multi-Factor Authentication (MFA), centralized authentication, and fine-grained authorization controls—managed entirely by athird-party provider—are classified asIdentity-as-a-Service (IDaaS).

IDaaS is a specialized cloud service model designed specifically foridentity management, including authentication, authorization, user provisioning, role-based access control, and centralized logging of authentication events. In forensic investigations, IDaaS platforms are critical evidence sources because they generatedetailed authentication logs, login timestamps, MFA challenges, IP addresses, device identifiers, and anomaly alerts. These logs allow investigators to correlate user identities with access patterns and trace unauthorized or malicious actions across multiple systems.

The CHFI v11 blueprint explicitly differentiates IDaaS from other cloud service models.IaaSfocuses on infrastructure resources such as virtual machines and networks, not identity enforcement.PaaSis used for developing and deploying custom applications, which is not indicated here since the authentication is handled by a third party.DaaSdelivers virtual desktops and does not inherently manage enterprise-wide authentication and authorization.

Therefore, based on the presence of third-party-managed SSO, MFA, centralized access control, and authentication log analysis, the correct answer—fully aligned with CHFI v11 documentation—isIdentity-as-a-Service (IDaaS).