Identity Federation and Single Sign-On (SSO) CSE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is choosing between SAML 2.0 and OpenID Connect for a new SSO implementation. The company has a mix of legacy web applications and modern mobile apps. The legacy apps require server-side sessions, while the mobile apps need to call APIs. Which protocol strategy best meets both requirements?

   • AUse only OIDC for all applications and require legacy apps to be modernized.
   • BUse SAML for legacy web apps and OIDC for mobile apps and APIs.
   • CUse only SAML for all applications and add a custom API layer.
   • DUse OAuth 2.0 for all applications and ignore the need for user identity.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company uses Okta as its identity provider (IdP) and wants employees to access a third-party SaaS application that acts as a service provider (SP). The SaaS application requires SAML 2.0 for federation. The administrator has already configured the trust relationship in Okta. What must the administrator do next to complete the federation setup?

   • AObtain the SP's SAML metadata and import it into Okta, then configure the attribute mapping for the application.
   • BCreate a user account in the SaaS application for every employee and manually set the same password as in Okta.
   • CConfigure the SaaS application to use OAuth 2.0 instead of SAML because OAuth is always easier to set up.
   • DAsk the SaaS vendor to disable its own authentication so that Okta can directly access its user database.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization is implementing SSO with an external IdP. They have two applications: App A supports SAML, and App B supports OIDC. The organization wants to minimize the risk of token replay attacks. Which configuration is most effective?

   • ADisable token encryption to reduce complexity.
   • BUse short token lifetimes and enforce audience and issuer validation in both applications.
   • CUse the same token for both applications to simplify management.
   • DUse long token lifetimes to reduce the frequency of authentication.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is integrating its cloud provider's identity service (e.g., AWS IAM Identity Center) with an external IdP for SSO. The company has multiple AWS accounts and wants to allow users to access resources in all accounts without re-authenticating. What is the recommended way to achieve this?

   • AUse AWS Organizations to automatically synchronize passwords from the external IdP.
   • BSet up a VPN to the external IdP and use LDAP to authenticate to AWS.
   • CCreate IAM users in each AWS account and set the same password as the external IdP.
   • DConfigure AWS IAM Identity Center to trust the external IdP and use permission sets to grant access across accounts.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is federating its on-premises IdP with a cloud provider's identity service. The cloud provider requires that the IdP's metadata be publicly accessible. The company is concerned about exposing internal details. What is the best way to address this concern?

   • ARefuse to publish metadata and manually provide the certificate and endpoints to the cloud provider.
   • BPublish the full metadata including all internal endpoints and certificates.
   • CPublish only the minimal metadata required, such as the entity ID, signing certificate, and SSO endpoint, and restrict access to the cloud provider's IP range if possible.
   • DUse a self-signed certificate that is not published in metadata.
   Reveal Solution Discussion Select an answer first