Federated Access and SSO GCAD Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is setting up a new SAML 2.0 federation between its IdP and a SaaS vendor. The vendor has provided its SAML metadata file. What should the IdP administrator do with this metadata to establish the trust relationship?

   • ASend the vendor's metadata to the certificate authority to generate a new signing certificate.
   • BImport the vendor's metadata into the IdP to configure the SP's entity ID, assertion consumer service URL, and signing certificate.
   • CStore the metadata file in a secure location and manually enter the SP's entity ID and ACS URL into the IdP.
   • DConvert the metadata into a JWT and configure the IdP to accept it as a token.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A security analyst is reviewing the SAML 2.0 configuration between the company's IdP and a third-party SP. The analyst discovers that the SP does not validate the signature on the SAML assertion. Which of the following attacks is most directly enabled by this misconfiguration?

   • AAn attacker can replay a previously captured SAML response to gain access, but only if the response is not expired.
   • BAn attacker can perform a denial-of-service attack by sending malformed SAML requests to the SP.
   • CAn attacker who can intercept the SAML response can modify the assertion's attributes (e.g., change the role to 'admin') and forward it to the SP.
   • DAn attacker can steal the IdP's private key and forge assertions.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a common security risk in federated identity environments?

   • ALack of user training.
   • BExcessive use of strong passwords.
   • CToken theft and replay.
   • DToo many identity providers.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a SAML assertion?

   • AA cryptographic key used to encrypt network traffic.
   • BA session cookie set by the service provider.
   • CA message that contains authentication and attribute statements about a user, issued by an identity provider.
   • DA request sent by a user to access a service.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How is trust typically established between an identity provider (IdP) and a service provider (SP) in SAML?

   • ABy using the same IP address range.
   • BBy using a shared secret password.
   • CBy configuring the same user database.
   • DBy exchanging metadata and certificates.
   Reveal Solution Discussion Select an answer first