Federated Access and SSO GCAD Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A security analyst is investigating a potential SAML assertion replay attack. The analyst notices that the SP does not track previously used assertion IDs. Which of the following is the most effective control to prevent replay attacks?

   • AImplement a cache of used assertion IDs and reject any assertion with a duplicate ID.
   • BRequire the SP to validate the IdP's signature on the assertion.
   • CShorten the assertion validity period to 30 seconds.
   • DUse a different binding for the SAML response.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a federated identity model, what is the role of the identity provider (IdP)?

   • AIt hosts the applications that users access.
   • BIt stores all user passwords for every service provider.
   • CIt validates the user's identity by checking a central database of all federated users.
   • DIt authenticates the user and issues an assertion about the user's identity.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security architect is reviewing a SAML federation setup. The IdP and SP exchange metadata over an unencrypted channel during initial configuration. An attacker intercepts the metadata and modifies the SP's assertion consumer service (ACS) URL to point to an attacker-controlled endpoint. What is the primary risk from this tampering?

   • AThe attacker can decrypt the SAML assertion because the metadata contains the SP's private key.
   • BThe attacker can cause a denial of service by changing the entity ID.
   • CThe attacker can receive SAML assertions intended for the legitimate SP, potentially gaining access to the user's session.
   • DThe attacker can forge the IdP's signature because the metadata contains the IdP's private key.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An organization has deployed SAML-based SSO for multiple SaaS applications. Users report that when they log out of one application, they remain logged in to the others. The security team wants to ensure that logging out of any one application terminates all federated sessions. Which of the following is the most effective solution?

   • ASet a short session timeout on each SP so sessions expire quickly.
   • BImplement SAML Single Logout (SLO) at the IdP and configure all SPs to support SLO.
   • CRequire users to clear their browser cookies after logging out.
   • DUse a central session management service that polls each SP for active sessions.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which component is central to WS-Federation's architecture?

   • AThe certificate authority that issues SSL certificates.
   • BThe authorization server that issues OAuth tokens.
   • CThe directory service that stores user attributes.
   • DThe security token service (STS) that issues tokens.
   Reveal Solution Discussion Select an answer first