A company is integrating its corporate IdP with a new SaaS application using SAML 2.0. The SaaS application is the service provider (SP). Which of the following responsibilities belongs to the SP in this federation?

Storing the user's password and managing password policies.

Authenticating the user and issuing the SAML assertion.

Generating the IdP's signing certificate.

Validating the SAML assertion and establishing a local session for the user.

A security team is reviewing the OAuth 2.0 implementation of a third-party application that integrates with their corporate identity provider. The application uses the authorization code flow and stores the client secret in its source code. An attacker gains access to the source code repository and extracts the client secret. Which of the following is the most effective mitigation to limit the impact of this compromise?

Add the attacker's IP address to a blocklist.

Rotate the client secret immediately and move the secret to a secure vault, and require PKCE for all authorization code flows.

Disable the client application until the source code is fixed.

Change the authorization server's signing key to invalidate all tokens.

In a JWT, what is a 'claim'?

The encryption key used to protect the token.

The header that specifies the signing algorithm.

A statement about the subject, such as name or role.

A cryptographic signature used to verify the token.

What is the role of the OASIS standard in identity federation?

It issues digital certificates for federation.

It regulates data privacy laws.

It provides cloud hosting for identity providers.

In a federated trust relationship, what is the primary responsibility of the identity provider (IdP)?

To manage the user's session after authentication.

To authenticate users and issue assertions about their identity.

To host the application and enforce access control policies.

To store user preferences and application settings.

GIAC Cloud Security Architecture and Design

Domain 1Objective 3

Federated Access and SSO GCAD Practice Questions (Page 10)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

15concepts

Questions 46–50

46application · medium
A company is integrating its corporate IdP with a new SaaS application using SAML 2.0. The SaaS application is the service provider (SP). Which of the following responsibilities belongs to the SP in this federation?
Select an answer first
47expert · medium
A security team is reviewing the OAuth 2.0 implementation of a third-party application that integrates with their corporate identity provider. The application uses the authorization code flow and stores the client secret in its source code. An attacker gains access to the source code repository and extracts the client secret. Which of the following is the most effective mitigation to limit the impact of this compromise?
Select an answer first
48foundation · easy
In a JWT, what is a 'claim'?
Select an answer first
49foundation · easy
What is the role of the OASIS standard in identity federation?
Select an answer first
50foundation · easy
In a federated trust relationship, what is the primary responsibility of the identity provider (IdP)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.