Objective 2.06 Explain the Characteristics (e.g., Pros and Cons, Restrictions, Security Implications) of Available SSO Profiles 304 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a recognized limitation of NTLM SSO compared to Kerberos SSO?

   • ANTLM SSO does not support delegation of credentials to backend applications.
   • BNTLM SSO is more secure because it uses a stronger encryption algorithm.
   • CNTLM SSO requires the client to be on the same network as the BIG-IP system.
   • DNTLM SSO is a stateless protocol that does not require a session.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a significant security implication of using a form-based SSO profile?

   • AIt requires the use of a client-side certificate for authentication.
   • BIt is inherently insecure because it stores passwords in plain text on the BIG-IP system.
   • CIt only works with applications that support OAuth.
   • DIt can be vulnerable to credential theft if the backend application does not use HTTPS.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is considering whether to use BIG-IP APM's built-in SSO profiles or an external SSO solution (e.g., a separate identity provider) for a new application deployment. The primary goal is to minimize the administrative overhead of managing user credentials for multiple backend applications. What is a key advantage of using APM's built-in SSO profiles in this scenario?

   • AThey centralize credential management and injection at the BIG-IP, so backend applications do not need to be individually configured for a federated protocol
   • BThey eliminate the need for a separate authentication server
   • CThey are always easier to configure than external SSO
   • DThey are the only way to provide SSO to cloud-based applications
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   An organization is using BIG-IP APM as a SAML identity provider for a SaaS application. The SaaS provider has recently updated their SAML requirements to mandate that the SubjectConfirmation method be 'bearer' and that the assertion must be signed. The APM administrator needs to update the existing SAML SSO profile. What must the administrator verify or configure?

   • AThe SaaS application's metadata is updated to include the new certificate
   • BThe user's browser is configured to trust the SaaS application's new certificate
   • CThe BIG-IP's clock is synchronized with the SaaS provider's server
   • DThe SAML SSO profile is configured to sign the assertion and that the SubjectConfirmation method is set to 'bearer'
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a key security consideration when using a Kerberos SSO profile?

   • AIt is only as secure as the strength of the user's password.
   • BThe user's password is sent in clear text to the backend application.
   • CIt is a stateless protocol and does not require any session management.
   • DThe BIG-IP system must be configured with a service principal name (SPN) that matches the backend application's service.
   Reveal Solution Discussion Select an answer first