Identity Federation and Single Sign-On (SSO) CSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is planning to implement SSO across multiple cloud applications. They have a requirement that when a user leaves the company, their access to all applications must be revoked within 15 minutes. Which SSO architecture best supports this requirement?

   • AUse an identity provider that supports real-time session revocation and configure all applications to use short-lived sessions with frequent token validation.
   • BUse SAML-based SSO with long-lived sessions and rely on the IdP to terminate sessions at the SPs.
   • CUse OAuth 2.0 with long-lived refresh tokens and rely on the IdP to revoke them.
   • DUse a directory synchronization tool to disable the user in all applications within 15 minutes.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization implements SSO across multiple cloud applications using a central identity provider. What is the primary security benefit of this approach?

   • AIt prevents any single application from seeing user attributes because tokens are encrypted.
   • BIt eliminates the need for multi-factor authentication because the identity provider is trusted.
   • CIt reduces the number of passwords users must remember, which encourages stronger password selection and reduces password reuse.
   • DIt ensures that all application sessions are terminated when the user closes the browser.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A user is already authenticated to the corporate identity provider and clicks a link to access a cloud application that uses OpenID Connect. What happens next in the SSO flow?

   • AThe application validates the user's existing session cookie from the corporate portal and grants access without contacting the IdP.
   • BThe application sends the user's username and password directly to the IdP's token endpoint to obtain an ID token.
   • CThe IdP sends the user's password hash to the application so it can verify the user's identity locally.
   • DThe application redirects the user to the IdP's authorization endpoint; the IdP recognizes the existing session and returns an authorization code without prompting for credentials.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization has implemented SSO using OpenID Connect (OIDC) with an external IdP. Users access multiple cloud applications through a portal. After a user authenticates, they can access all applications without re-entering credentials. However, when the user's account is disabled in the IdP, they can still access the applications for up to an hour. What is the most likely reason for this?

   • AThe applications are using SAML instead of OIDC, and SAML assertions are valid for an hour.
   • BThe IdP uses long-lived refresh tokens that are not revoked when the user is disabled.
   • CThe applications cache the ID token and do not validate it against the IdP on every request.
   • DThe user's browser has cached the authentication cookies from the IdP.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is implementing SSO for its employees using an external IdP. The IdP supports both SAML and OIDC. The company wants to provide SSO for a legacy on-premises web application that does not support modern protocols but can accept a SAML assertion. They also want to use the same IdP for a new cloud application that uses OIDC. What is the best approach?

   • AUse SAML for both applications and require the cloud application to support SAML.
   • BUse two separate IdPs, one for each application, to avoid protocol conflicts.
   • CUse OIDC for both applications and install a gateway to translate OIDC to SAML for the legacy app.
   • DConfigure the legacy application to use SAML and the cloud application to use OIDC, both with the same IdP.
   Reveal Solution Discussion Select an answer first