Federated Access and SSO GCAD Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A developer is implementing OpenID Connect for a web application. The application receives an ID token from the identity provider. Which of the following is the primary purpose of the ID token?

   • ATo encrypt the user's password and transmit it securely to the application.
   • BTo provide a long-lived session token that can be used for offline access.
   • CTo authenticate the user to the application and convey identity claims such as name and email.
   • DTo authorize the application to access the user's resources on a third-party API.
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   What is the primary purpose of single sign-on (SSO)?

   • ATo eliminate the need for passwords altogether.
   • BTo provide a single password for all applications.
   • CTo store all user credentials in a single database.
   • DTo allow users to authenticate once and gain access to multiple applications without re-entering credentials.
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   How are sessions typically managed between the IdP and SP in an SSO environment?

   • AThe SP stores the user's password to maintain the session.
   • BThe IdP and SP share a single session cookie.
   • CThe IdP maintains a session, and the SP creates its own session based on the assertion.
   • DThe IdP sends the session ID to the SP via email.
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   In a SAML 2.0 web-based SSO flow, what is the role of the service provider (SP)?

   • AIt authenticates the user and creates a SAML assertion.
   • BIt redirects the user to the identity provider for authentication and then consumes the assertion to grant access.
   • CIt stores all user credentials for the federation.
   • DIt issues security tokens to the user for accessing multiple SPs.
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A company is integrating a new SaaS application that supports SAML 2.0. The company's identity team has configured the IdP to send a SAML assertion to the SaaS application. The SaaS application is rejecting the assertion with a signature validation error. The team has verified that the assertion is correctly signed and the certificate is valid. What is the most likely cause of the issue?

   • AThe IdP is using the HTTP POST binding instead of the redirect binding.
   • BThe user's browser has cached an old SAML response.
   • CThe SaaS application's metadata does not include the IdP's signing certificate.
   • DThe assertion's audience restriction does not match the SaaS application's entity ID.
   Reveal Solution Discussion Select an answer first