Objective 2.06 Explain the Characteristics (e.g., Pros and Cons, Restrictions, Security Implications) of Available SSO Profiles 304 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security auditor is reviewing the BIG-IP APM configuration. The auditor notes that a Form-Based SSO profile is being used for a critical application. The auditor's primary security concern with this SSO profile type is that:

   • AThe user's password is handled by the BIG-IP and could be exposed in logs or memory if not properly secured
   • BThe SSO profile requires the use of a shared service account
   • CThe SSO profile cannot be used with HTTPS
   • DThe SSO profile is vulnerable to SQL injection attacks on the login form
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An APM administrator is configuring Kerberos SSO for a backend application. The administrator has created a Kerberos delegation account and configured the SSO profile. However, users are reporting that SSO is failing. The administrator checks the BIG-IP logs and sees errors related to 'KDC_ERR_S_PRINCIPAL_UNKNOWN'. What is the most likely cause of this error?

   • AThe backend application is not listening on port 80
   • BThe Service Principal Name (SPN) for the backend application is not registered correctly in Active Directory
   • CThe BIG-IP is not a member of the Active Directory domain
   • DThe user's password is incorrect
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is deploying BIG-IP APM to provide SSO to a Microsoft SharePoint farm that is integrated with Active Directory. The administrator wants to provide a seamless, transparent SSO experience where the user is not prompted for credentials again. The APM server is a member of the same Active Directory domain as the SharePoint servers. Which SSO profile type is the most appropriate for this scenario?

   • ASAML SSO
   • BHTTP Basic SSO
   • CForm-Based SSO
   • DKerberos SSO
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a key advantage of using an OAuth/OIDC SSO profile for modern applications?

   • AIt is the most secure method and does not require any additional security considerations.
   • BIt is a simple protocol that is easy to implement without any server-side components.
   • CIt is a legacy protocol that is only supported by older applications.
   • DIt is designed for mobile and single-page applications that cannot use traditional session cookies.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which statement correctly describes the purpose of SSO profiles in BIG-IP APM?

   • AThey automate the process of authenticating the user to backend web applications after the initial APM authentication.
   • BThey manage the lifecycle of access tokens issued to client devices after successful authentication.
   • CThey define how the APM system authenticates users against an external identity provider.
   • DThey control the encryption algorithms used for traffic between the client and the BIG-IP system.
   Reveal Solution Discussion Select an answer first