Identity Federation and Single Sign-On (SSO) CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is investigating a potential SSO vulnerability. They suspect an attacker could replay a captured SAML assertion to gain access to a cloud application. Which control is most effective at preventing assertion replay?

   • ARequiring the assertion to be sent over HTTPS.
   • BEncrypting the assertion with the SP's public key.
   • CIncluding a short NotOnOrAfter condition and a unique assertion ID, and having the SP track used assertion IDs.
   • DUsing a longer assertion validity period to reduce the chance of clock skew issues.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which federation standard is most commonly used for browser-based single sign-on across enterprise applications and is based on XML?

   • AOAuth 2.0
   • BKerberos
   • CSAML 2.0
   • DOpenID Connect
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is integrating its cloud provider's identity service with an external IdP for SSO. The company has a strict requirement that all authentication must be done by the external IdP, and the cloud provider must not store any user passwords. Which integration approach satisfies this requirement?

   • AUse OAuth 2.0 client credentials flow with the external IdP.
   • BUse SAML 2.0 federation where the cloud provider trusts the external IdP and does not store user passwords.
   • CUse the cloud provider's identity store as the primary and sync passwords from the external IdP.
   • DCreate federated users in the cloud provider with the same passwords as the external IdP.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is federating its on-premises Active Directory with a cloud SaaS application. The SaaS application supports both SAML 2.0 and OpenID Connect. The company's security policy requires that the federation protocol support multifactor authentication (MFA) enforcement at the IdP and allow the SaaS application to receive user attributes such as department and role. Which protocol should the company choose?

   • ALDAP, because it can provide user attributes directly.
   • BOpenID Connect, because it is newer and more secure than SAML.
   • CSAML 2.0, because it natively supports attribute statements and can carry MFA context.
   • DOAuth 2.0, because it is the standard for authentication and authorization.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is integrating its on-premises Active Directory with a cloud SaaS application via SAML federation. The company has a strict security policy that requires all authentication to be challenged with MFA, and they want to minimize the number of systems that handle user credentials. Which architecture best meets these requirements?

   • AUse a third-party cloud IdP and replicate all AD users to it, then enforce MFA at the cloud IdP.
   • BUse the SaaS application's built-in MFA and synchronize password hashes to the cloud.
   • CSet up a federation trust between AD and the SaaS application without an on-premises IdP.
   • DDeploy AD FS as the IdP and enforce MFA at AD FS, then federate to the SaaS application.
   Reveal Solution Discussion Select an answer first