Identity Federation and Single Sign-On (SSO) CSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is troubleshooting a SAML federation issue. Users are intermittently unable to sign in to a cloud application, and the error logs show 'SAML assertion signature validation failed.' The IdP's signing certificate is due to expire soon. What is the most likely cause of the intermittent failures?

   • AThe user's browser is blocking cookies, causing the IdP to issue unsigned assertions.
   • BThe SP's ACS URL is misconfigured, causing assertions to be sent to the wrong endpoint.
   • CThe SP is using an expired certificate to encrypt assertions.
   • DThe IdP is signing assertions with a new certificate that the SP does not yet trust.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security administrator is reviewing the federation configuration between the company's IdP and a cloud SaaS provider. The SaaS provider uses SAML 2.0. Which of the following is the most important security control to verify to prevent forged authentication assertions?

   • AThe SAML assertion contains the user's email address.
   • BThe SaaS provider's ACS URL is configured to use HTTPS.
   • CThe IdP and SaaS provider use the same certificate for signing and encryption.
   • DThe IdP's signing certificate is trusted by the SaaS provider and the assertion signature is validated.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's cloud application receives a SAML assertion from an external identity provider. Which validation step is most important to prevent an attacker from forging an assertion?

   • ACheck that the user's email address in the assertion matches the email in the application's database.
   • BVerify the digital signature of the assertion using the IdP's public certificate.
   • CConfirm that the assertion was sent over HTTPS by checking the TLS certificate of the connection.
   • DEnsure the assertion contains a valid audience restriction that matches the application's entity ID.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is establishing a federation trust with a partner organization. The partner will act as the IdP, and the company's cloud application will be the SP. The company wants to ensure that only users from the partner's HR system can access the application. What is the most reliable way to enforce this?

   • ARequire the partner to use a separate IdP for HR users.
   • BRely on the partner IdP to only send assertions for HR users.
   • CConfigure the SP to validate the issuer and the audience, and also check a custom attribute in the assertion that identifies the user as an employee.
   • DUse a shared secret between the SP and the partner's HR system.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A developer is building a web application that needs to authenticate users via an external IdP. The application will run on a server and needs to obtain information about the user, such as name and email, after authentication. The application also needs to call an API on behalf of the user. Which protocol and flow should the developer use?

   • ASAML 2.0 with HTTP-POST binding
   • BOAuth 2.0 with the client credentials flow
   • COAuth 2.0 with the implicit flow
   • DOpenID Connect with the authorization code flow
   Reveal Solution Discussion Select an answer first