Objective 2.07 Explain the Implications of Passwordless Authentication Options in APM and How They Affect SSO (e.g., SAML, Client Certificate, NTLM-end-user) 304 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An APM log message contains the following components: a timestamp, a session ID, a username, and an event type. Which component uniquely identifies a single user's access session for correlation across multiple log entries?

   • ATimestamp
   • BSession ID
   • CEvent type
   • DUsername
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An APM administrator is analyzing logs for a SAML SSO flow. The user successfully authenticates via SAML, but the SSO to the backend application fails. The logs show the SAML authentication succeeded, but the SSO token request failed. The administrator notices that the SSO token request log entry has a different session ID than the SAML authentication log entry. What is the most likely cause of the SSO failure?

   • AThe backend application rejected the SSO token because it was expired.
   • BThe APM access policy denied the user after the SSO token request.
   • CThe user's browser did not send the SAML assertion to the APM virtual server.
   • DThe SAML authentication and SSO token request were handled by different APM virtual servers, resulting in different sessions.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An administrator is troubleshooting a SAML SSO failure. The access log shows the SAML authentication succeeded, but the SSO token request to the backend application failed. The administrator needs to find the log entry for the SSO token request. Which field in the log message would allow the administrator to identify this specific event?

   • AThe session ID field, which would show the session associated with the request.
   • BThe timestamp field, which would show when the request was made.
   • CThe username field, which would show the user who made the request.
   • DThe event type field, which would indicate an SSO token request.
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   An APM administrator is troubleshooting a failed passwordless SAML SSO flow. Which APM log entry pattern is most directly used to correlate the SAML authentication event with the subsequent SSO session establishment?

   • AA log entry that records the user's password hash and the SSO token in the same message
   • BA log entry containing the SAML assertion ID and a separate entry containing the corresponding session ID, linked by a common request ID
   • CA log entry that contains the NTLM challenge-response value and the SSO cookie name
   • DA log entry that shows the client certificate's serial number and the SAML assertion ID in the same message
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When troubleshooting an APM access policy, an administrator wants to view authentication events directly on the BIG-IP without configuring an external log destination. Which logging facility should they use?

   • ARemote syslog
   • BLocal logging
   • CPacket tracing
   • DHigh-Speed Logging (HSL)
   Reveal Solution Discussion Select an answer first