Federated Access and SSO GCAD Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A large enterprise is considering using WS-Federation to integrate its on-premises Active Directory Federation Services (AD FS) with a legacy line-of-business application. The application is hosted on-premises and supports WS-Federation. What is a key advantage of using WS-Federation in this scenario compared to SAML 2.0?

   • AWS-Federation provides better support for mobile and single-page applications than SAML 2.0.
   • BWS-Federation is tightly integrated with the .NET framework and AD FS, making it easier to configure for Microsoft-centric environments.
   • CWS-Federation supports both active and passive profiles, making it more flexible than SAML 2.0.
   • DWS-Federation uses JSON Web Tokens (JWT) by default, which are more secure than SAML assertions.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A large enterprise has an existing on-premises Active Directory Federation Services (AD FS) infrastructure that uses WS-Federation to provide SSO to internal web applications. The company is now integrating a new cloud application that only supports SAML 2.0. The architect wants to reuse the existing AD FS infrastructure. What should the architect do?

   • AUse a federation proxy to translate WS-Federation to SAML 2.0 for the new application.
   • BConfigure the new cloud application to use WS-Federation instead of SAML 2.0.
   • CReplace AD FS with a new identity provider that only supports SAML 2.0.
   • DConfigure AD FS to act as a SAML 2.0 identity provider for the new cloud application while continuing to use WS-Federation for existing applications.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A developer is implementing OpenID Connect for a single-page application (SPA). The application needs to authenticate users and call an API on their behalf. Which of the following is the recommended flow for this scenario?

   • AClient credentials flow
   • BImplicit flow with access tokens in the URL fragment
   • CAuthorization code flow with PKCE
   • DResource owner password credentials flow
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary benefit of federated identity in a multi-domain environment?

   • AIt requires all participating domains to use the same identity provider.
   • BIt eliminates the need for any identity verification at the service provider.
   • CIt allows users to use the same digital identity across multiple security domains without re-authenticating at each domain.
   • DIt stores all user credentials in a central repository accessible to all domains.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is implementing SAML 2.0 federation with a partner organization. The partner's SP requires the SAML assertion to include the user's role and department for authorization decisions. The company's IdP currently only sends the user's email address. What should the IdP administrator do to meet the SP's requirement?

   • AUse OAuth 2.0 scopes to convey the role and department information.
   • BCreate a new SAML assertion that includes the attributes and send it to the SP via a separate channel.
   • CAsk the SP to modify its application to derive role and department from the email address.
   • DConfigure the IdP to include the required attributes (role and department) in the SAML assertion, and ensure the attribute names match the SP's expectations.
   Reveal Solution Discussion Select an answer first