Objective 2.06 Explain the Characteristics (e.g., Pros and Cons, Restrictions, Security Implications) of Available SSO Profiles 304 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is setting up SSO for a simple internal status page that is protected by HTTP Basic authentication. The page is hosted on a server that does not support any other authentication method. The APM administrator needs to configure an SSO profile. What is a primary limitation of using an HTTP Basic SSO profile in this scenario?

   • AHTTP Basic SSO only works with Microsoft Internet Explorer
   • BHTTP Basic SSO cannot be used with virtual servers that have a client SSL profile
   • CThe credentials are sent as base64-encoded text, which is not encrypted and can be easily decoded if the traffic is intercepted
   • DHTTP Basic SSO requires the user to enter their credentials every time
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a notable security benefit of using Kerberos SSO compared to form-based or HTTP Basic SSO?

   • AIt is a stateless protocol that does not require session management.
   • BIt is easier to configure and requires less infrastructure.
   • CIt uses a ticketing system that does not transmit the user's password over the network.
   • DIt relies on a shared secret that is stored in the browser's cache.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is implementing a new cloud-based SaaS application that supports SAML 2.0. The company wants to use BIG-IP APM as the identity provider (IdP) to provide SSO to this application. The APM administrator is configuring the SAML SSO profile. What is a critical prerequisite for this configuration?

   • AThe SaaS application must be hosted in the same data center as the BIG-IP
   • BThe BIG-IP must be able to reach the SaaS application's database directly
   • CA trust relationship must be established between the BIG-IP and the SaaS application using exchanged metadata
   • DThe user's browser must be configured to trust the SaaS application's certificate
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does an HTTP Basic SSO profile in BIG-IP APM authenticate a user to a backend application?

   • ABy using a Kerberos service ticket obtained from a Key Distribution Center.
   • BBy submitting a hidden HTML form to the application's login page.
   • CBy including the user's credentials in the HTTP Authorization header.
   • DBy establishing a secure TLS session and using client certificates.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company has a mix of backend applications. Some support Kerberos, and some only support NTLM. The APM administrator wants to provide SSO to all of them. What is a key reason the administrator might choose an NTLM SSO profile over a Kerberos SSO profile for a specific application?

   • AThe application is hosted on a server that is not a member of the Active Directory domain
   • BNTLM SSO does not require the BIG-IP to be domain-joined
   • CNTLM SSO provides a more transparent user experience than Kerberos
   • DNTLM SSO is inherently more secure than Kerberos SSO
   Reveal Solution Discussion Select an answer first