Federated Access and SSO GCAD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is building a mobile app that needs to access a user's calendar data from a third-party provider. The app should not see the user's password, and the user should be able to grant limited access (e.g., read-only) without giving the app full account control. Which protocol should the app use to obtain access to the calendar data?

   • ASAML 2.0 with an assertion containing calendar permissions
   • BOAuth 2.0 with an authorization code flow and scopes
   • CWS-Federation with a security token containing claims
   • DOpenID Connect with the implicit flow
   Reveal Solution Discussion Select an answer first
2. 32expert · medium

   A company is setting up SAML 2.0 federation with a new SaaS vendor. The vendor's metadata file contains an X.509 certificate that will be used to verify the vendor's SAML requests. The company's IdP administrator imports the metadata. Later, the vendor rotates their certificate and updates their metadata. What must the administrator do to maintain the trust relationship?

   • AUpdate the IdP's signing certificate to match the vendor's new certificate.
   • BDo nothing because the IdP automatically retrieves the latest metadata from the vendor's URL.
   • CManually update the IdP with the new metadata and certificate, and ensure the old certificate is removed to prevent confusion.
   • DAsk the vendor to keep using the old certificate until the IdP is updated.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In an OpenID Connect flow, what is the purpose of the ID token?

   • ATo encrypt the user's password.
   • BTo authorize access to a specific resource.
   • CTo establish a session between the client and the resource server.
   • DTo authenticate the user and convey identity information.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company has multiple SaaS applications that each require separate logins. Employees are frustrated with remembering multiple passwords, and the help desk receives many password reset requests. The company wants to improve user experience and reduce credential fatigue. Which solution should the architect recommend?

   • AImplement MFA for each application separately.
   • BSet a longer password expiration period for all applications.
   • CUse a password manager to store all passwords for users.
   • DImplement SSO using a federated identity provider so users authenticate once and access all applications.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company wants to allow its employees to access Microsoft 365 using their on-premises Active Directory credentials. The company has deployed AD FS and wants to configure federation with Microsoft 365. What must the architect configure in Microsoft 365 to establish the trust?

   • AConfigure Microsoft 365 to use OpenID Connect with AD FS as the authorization server.
   • BAdd the AD FS federation metadata as a trusted identity provider in Microsoft 365.
   • CSet up a VPN between the corporate network and Microsoft 365 to allow direct LDAP queries.
   • DCreate a user account in Microsoft 365 for each employee and set the password to match Active Directory.
   Reveal Solution Discussion Select an answer first