Identity Federation and Single Sign-On (SSO) CSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In an identity federation model, which statement best describes the role of an identity provider (IdP)?

   • AIt is the network gateway that encrypts all traffic between users and cloud services.
   • BIt stores user passwords in a central database and synchronizes them to all service providers.
   • CIt hosts the application or service that users want to access.
   • DIt authenticates users and issues assertions or tokens that are trusted by service providers.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security administrator is reviewing the federation configuration between the company's IdP and a new SaaS application. The IdP's signing certificate is set to expire in 30 days. What is the best practice to avoid an SSO outage?

   • AWait until the certificate expires, then generate a new one and update the SP immediately.
   • BDisable certificate validation on the SP to avoid the issue.
   • CExtend the validity of the existing certificate by modifying its expiration date.
   • DGenerate a new certificate and publish it in the IdP's metadata well before the expiration, while keeping the old certificate valid during the transition.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is evaluating federation between its on-premises identity provider and a cloud service. The cloud service requires that the IdP's signing certificate be uploaded to its configuration. What does this step establish?

   • AA trust relationship in which the cloud service will accept assertions signed by that certificate.
   • BA user directory synchronization job between the IdP and the cloud service.
   • CAn encrypted channel between the IdP and the cloud service for all future communication.
   • DA shared secret that the IdP will use to authenticate to the cloud service.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is federating its IdP with a cloud application using SAML. The security team wants to ensure that only users who have completed MFA can access the application. The IdP supports MFA and can include authentication context in the SAML assertion. However, the application vendor says it does not parse the authentication context. What is the best way to enforce the MFA requirement?

   • AAsk the vendor to update their application to parse the authentication context.
   • BRely on the application's own MFA settings.
   • CConfigure the IdP to require MFA for the application's user group and rely on the IdP to enforce it.
   • DUse a separate IdP for users who need MFA.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company uses Okta as its identity provider and needs to give employees single sign-on access to a new SaaS application that only supports SAML 2.0. The application is the service provider. Which configuration step is essential for establishing the federation trust?

   • ACreate a user account in the SaaS application for every employee and store the same password as in Okta to enable SSO.
   • BExchange SAML metadata between Okta and the SaaS application, including the IdP's signing certificate and the SP's assertion consumer service URL.
   • CConfigure the SaaS application to call Okta's OAuth 2.0 token endpoint directly to obtain an access token for each user.
   • DInstall Okta's root CA certificate on every employee's workstation so the SaaS application can trust the IdP.
   Reveal Solution Discussion Select an answer first