Identity Federation and Single Sign-On (SSO) CSE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company is troubleshooting an SSO failure. Users can authenticate at the IdP, but the SaaS application rejects the SAML assertion with an 'Invalid audience' error. What is the most likely cause?

   • AThe assertion's AudienceRestriction does not match the application's entity ID.
   • BThe SP's ACS URL is incorrect.
   • CThe IdP's signing certificate is expired.
   • DThe user's account is locked in the IdP.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When integrating a cloud provider's identity service with an external IdP for SSO, what is typically required to establish the trust?

   • AConfiguring the cloud provider to use the external IdP's user database directly.
   • BExchanging metadata and certificates between the cloud provider and the external IdP.
   • CCreating a VPN connection between the cloud provider and the external IdP's network.
   • DSharing user passwords between the cloud provider and the external IdP.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company uses AWS IAM Identity Center (successor to AWS SSO) and wants to give users access to multiple AWS accounts using their existing corporate credentials from Microsoft Entra ID. Which integration approach is correct?

   • AUse AWS Directory Service to replicate Microsoft Entra ID into AWS.
   • BCreate IAM users in each AWS account with the same passwords as in Microsoft Entra ID.
   • CConfigure IAM Identity Center as the SP and Microsoft Entra ID as the external IdP, then assign users and groups to AWS accounts and permission sets.
   • DEstablish a direct SAML trust between each AWS account and Microsoft Entra ID, bypassing IAM Identity Center.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is planning to implement SSO for its employees. The security team wants to ensure that if an employee leaves the company, their access to all cloud applications is revoked as quickly as possible. Which SSO implementation approach best supports this requirement?

   • AUse an external IdP as the central authentication point and disable the user's account there.
   • BUse SSO with short-lived tokens and rely on token expiration for revocation.
   • CUse SSO with long-lived tokens that never expire.
   • DUse individual application passwords and disable each account manually when an employee leaves.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the purpose of configuring a cloud provider as a service provider (SP) in a federation with an external IdP?

   • ATo enable the cloud provider to accept identity assertions from the external IdP and grant access to cloud resources.
   • BTo let the external IdP access cloud resources directly on behalf of users.
   • CTo synchronize user accounts from the cloud provider to the external IdP.
   • DTo allow the cloud provider to authenticate users using its own identity store.
   Reveal Solution Discussion Select an answer first