Objective 2.07 Explain the Implications of Passwordless Authentication Options in APM and How They Affect SSO (e.g., SAML, Client Certificate, NTLM-end-user) 304 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An administrator is correlating APM logs for a SAML SSO flow. The user successfully authenticates via SAML, but the SSO to the backend application fails. The administrator finds a log entry with the username 'john.doe' and a session ID 'abc123', but the SSO token request log entry has a different session ID 'def456'. What is the most likely cause of the SSO failure?

   • AThe user's browser did not send the SAML assertion to the APM virtual server.
   • BThe backend application rejected the SSO token because it was expired.
   • CThe APM access policy denied the user after the SSO token request.
   • DThe SAML authentication and SSO token request were handled by different APM virtual servers, resulting in different sessions.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization uses APM with NTLM-end-user authentication. The security team wants to audit all authentication attempts, including successful and failed ones. The administrator needs to ensure that APM logs these events. What should the administrator configure?

   • AEnable local logging for the APM access policy.
   • BEnable SNMP traps for authentication events.
   • CEnable TCP dump on the APM virtual server.
   • DEnable High-Speed Logging (HSL) to a remote syslog server.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of SSO-related information that would be captured in APM logs?

   • AThe user's password hash
   • BThe SAML assertion attributes
   • CThe full contents of the user's browser cookies
   • DThe private key of the client certificate
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An administrator is troubleshooting a client certificate authentication flow in APM. The user's certificate is valid, but the access policy fails. The administrator needs to find the specific log entry for this user's session to see why the certificate validation failed. Which combination of fields in the APM log message would allow the administrator to uniquely identify and filter for this user's session?

   • ASession ID and username
   • BTimestamp and username
   • CEvent type and timestamp
   • DSource IP and destination IP
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When interpreting an APM log message, which component indicates the nature of the logged event, such as 'authentication succeeded' or 'access policy denied'?

   • ATimestamp
   • BEvent type
   • CSession ID
   • DUsername
   Reveal Solution Discussion Select an answer first