Federated Access and SSO GCAD Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the role of the service provider (SP) in a federated trust relationship?

   • ATo authenticate the user and issue tokens.
   • BTo consume the assertion from the IdP and grant access to its resources.
   • CTo store the user's credentials for all federated services.
   • DTo issue certificates to the IdP.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key strength of OpenID Connect (OIDC) over SAML 2.0?

   • AIt provides stronger encryption than SAML.
   • BIt is specifically designed for enterprise federation.
   • CIt is simpler and more modern, using JSON and REST.
   • DIt uses XML for message formatting.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company wants to allow employees to sign in to the AWS Management Console using their corporate credentials. The company runs an on-premises Active Directory and wants to avoid storing corporate passwords in AWS. Which approach should the architect implement?

   • ASet up a VPN between the corporate network and AWS and use LDAP directly against the corporate directory.
   • BConfigure AWS IAM as the service provider and the corporate AD as the identity provider using SAML 2.0 federation.
   • CCreate IAM users in AWS with the same usernames and passwords as the corporate directory and enable MFA.
   • DUse OAuth 2.0 to let AWS validate the corporate access token directly.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is single logout (SLO) in an SSO environment?

   • AThe process of deleting the user's account from the IdP.
   • BThe process of logging out only from the current application.
   • CThe process of terminating the user's session at the IdP and all SPs that the user has accessed.
   • DThe process of clearing the browser cache.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A development team is building a microservices-based application that uses OpenID Connect for authentication. The API gateway receives a JWT from the client and needs to authorize the request. The gateway does not have network access to the identity provider. What should the gateway do to validate the JWT?

   • ADecode the JWT payload and trust the claims without verifying the signature.
   • BUse the JWT's key ID to look up the secret in a local database.
   • CValidate the JWT signature using the IdP's public key from its JWKS endpoint and check the claims.
   • DForward the JWT to the identity provider for validation on every request.
   Reveal Solution Discussion Select an answer first