What is the redirect-based SSO pattern?

The SP sends a direct HTTP request to the IdP to authenticate the user.

The IdP and SP share a session cookie.

The user submits a form directly to the SP with their credentials.

The user is redirected to the IdP for authentication, and then redirected back to the SP with an assertion.

A company is integrating a new SaaS application that will use SAML 2.0 for SSO. The SaaS application needs to receive the user's department and job title to determine access permissions. The company's IdP has these attributes in its directory. What is the IdP's responsibility in this federated setup?

Generate a JWT with the attributes and send it to the SP.

Store the user's session and provide a REST API for the SP to query attributes.

Validate the SAML assertion and enforce access permissions based on the attributes.

Authenticate the user and issue a SAML assertion that includes the required attributes.

A company is merging with another organization. The two companies use different identity providers (IdPs). The merged company wants to allow employees from both organizations to access a shared set of cloud applications using their existing corporate credentials. Which approach best enables this?

Migrate all users to a single on-premises directory and use that as the only IdP.

Use a third-party identity broker that stores all users' passwords and authenticates them on behalf of both IdPs.

Establish a federation between the two IdPs so that each organization's IdP trusts the other and can accept assertions from the other.

Create a new identity in the cloud applications for each employee from both organizations.

A company is designing a new cloud-based application that will be used by both internal employees and external partners. The application needs to support browser-based SSO for employees and also allow partners to authenticate using their own corporate credentials. The company wants to minimize the number of protocols to maintain. Which approach is the most appropriate?

Use WS-Federation for internal employees and SAML 2.0 for external partners.

Use a proprietary token format that is only used by the company's applications.

Use SAML 2.0 for internal employees and OAuth 2.0 for external partners.

Use OpenID Connect as the primary protocol, and allow partners to connect via OIDC federation.

What is the purpose of metadata in a SAML federation?

To describe the endpoints, certificates, and capabilities of the IdP and SP.

To log all authentication events.

To store user attributes for authorization.

To encrypt the SAML assertions.

GIAC Cloud Security Architecture and Design

Domain 1Objective 3

Federated Access and SSO GCAD Practice Questions (Page 2)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

15concepts

Questions 6–10

6foundation · easy
What is the redirect-based SSO pattern?
Select an answer first
7application · medium
A company is integrating a new SaaS application that will use SAML 2.0 for SSO. The SaaS application needs to receive the user's department and job title to determine access permissions. The company's IdP has these attributes in its directory. What is the IdP's responsibility in this federated setup?
Select an answer first
8application · medium
A company is merging with another organization. The two companies use different identity providers (IdPs). The merged company wants to allow employees from both organizations to access a shared set of cloud applications using their existing corporate credentials. Which approach best enables this?
Select an answer first
9expert · medium
A company is designing a new cloud-based application that will be used by both internal employees and external partners. The application needs to support browser-based SSO for employees and also allow partners to authenticate using their own corporate credentials. The company wants to minimize the number of protocols to maintain. Which approach is the most appropriate?
Select an answer first
10foundation · easy
What is the purpose of metadata in a SAML federation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Federated Access and SSO GCAD Practice Questions (Page 2)

Questions 6–10

What is the redirect-based SSO pattern?

A company is merging with another organization. The two companies use different identity providers (IdPs). The merged company wants to allow employees from both organizations to access a shared set of cloud applications using their existing corporate credentials. Which approach best enables this?

What is the purpose of metadata in a SAML federation?

Keep studying — Identity and Access Management