Identity Federation and Single Sign-On (SSO) CSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company wants to allow employees to sign in to Microsoft 365 using their existing on-premises Active Directory credentials. They plan to use Azure AD (now Microsoft Entra ID) as the identity provider. Which configuration is required to establish the federation trust?

   • AUse Azure AD Connect to synchronize password hashes and enable pass-through authentication instead of federation.
   • BConfigure Active Directory Federation Services (AD FS) as the IdP and add Microsoft Entra ID as a trusted relying party, then exchange metadata and certificates.
   • CInstall the Microsoft Entra ID certificate on each domain controller so that AD can directly authenticate users to Microsoft 365.
   • DCreate a one-way forest trust between the on-premises domain and Microsoft Entra ID.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is building a custom web application that needs to authenticate users via their existing Google accounts and also call Google APIs on behalf of those users. Which protocol should the application use?

   • ASAML 2.0 for both authentication and API authorization.
   • BOAuth 2.0 alone for both authentication and API authorization.
   • COpenID Connect for authentication and OAuth 2.0 for API authorization.
   • DLDAP to authenticate directly against Google's user directory.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company uses Microsoft Entra ID (Azure AD) as its cloud identity provider. They want to allow employees to sign in to AWS accounts using their existing corporate credentials. They plan to use AWS IAM Identity Center (successor to AWS SSO) with SAML 2.0 federation. What is the first step they should perform in the integration?

   • AConfigure Entra ID as an external identity provider in AWS IAM Identity Center and exchange SAML metadata.
   • BSet up a VPN between the corporate network and AWS to allow direct authentication.
   • CCreate an IAM role in each AWS account that trusts the SAML IdP.
   • DCreate a user in AWS IAM for each employee and assign the same password as in Entra ID.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security administrator is reviewing the federation trust between the company's IdP and a cloud application. The application is configured to accept assertions from the IdP. During a penetration test, the administrator discovers that the application does not validate the issuer field in the SAML assertion. What is the most likely security impact?

   • AThe application will be unable to decrypt the assertion.
   • BAn attacker could forge an assertion from a different IdP and gain access.
   • CThe application will not be able to map the user to a local account.
   • DThe user's session will be shorter than expected.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the role of a token in cloud SSO implementation?

   • AIt contains the user's password and credentials for the service provider.
   • BIt encrypts all data transmitted between the user and the cloud service.
   • CIt is a signed piece of data that the service provider validates to establish a user session.
   • DIt is a temporary key that grants the user administrative access to the cloud environment.
   Reveal Solution Discussion Select an answer first