Federated Access and SSO GCAD Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the benefit of using federated identity to access a cloud provider like Azure Active Directory?

   • AUsers can use their existing corporate credentials to access cloud resources.
   • BIt allows the cloud provider to store user passwords.
   • CIt eliminates the need for any security controls in the cloud.
   • DIt automatically encrypts all data in the cloud.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the artifact binding in SAML?

   • AThe SAML message is sent directly in the URL.
   • BThe assertion is sent via email.
   • CThe assertion is embedded in a hidden form field.
   • DA small reference (artifact) is sent to the SP, which then retrieves the actual assertion from the IdP.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company is evaluating protocols for a new customer-facing web application that needs to support social login (e.g., Google, Facebook) and also allow users to access a REST API. The development team wants a single protocol that can handle both authentication and API authorization. Which protocol should the architect recommend?

   • AOAuth 2.0
   • BSAML 2.0
   • CWS-Federation
   • DOpenID Connect
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company is building a mobile app that will let users sign in with their existing corporate accounts. The app needs to call a REST API on behalf of the user. The security team wants to avoid exposing the user's password to the app and wants the API to validate the user's identity without making a separate call back to the corporate identity provider on every request. Which approach should the architect recommend?

   • AUse WS-Federation with a passive sign-in flow and a security token that the API parses.
   • BUse SAML 2.0 with an artifact binding so the API can resolve the artifact against the identity provider.
   • CUse OAuth 2.0 with the authorization code flow and a JWT access token that contains identity claims.
   • DUse OpenID Connect with the implicit flow and return the ID token directly to the app for API authorization.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security architect is reviewing a federated SSO deployment where users authenticate at an on-premises IdP and then access a SaaS application. The SaaS application accepts SAML assertions but does not enforce a maximum session lifetime. The IdP issues assertions with a SessionNotOnOrAfter condition of 8 hours. An attacker steals a valid assertion from a user's browser history. Which control would most directly limit the attacker's ability to reuse that assertion?

   • ARequire the IdP to sign the assertion with a short-lived certificate that rotates every 24 hours.
   • BEnable single logout (SLO) at the IdP so that logging out terminates the SP session.
   • CConfigure the SaaS application to honor the SessionNotOnOrAfter condition and terminate the session at that time.
   • DUse the artifact binding so the assertion is never exposed in the browser.
   Reveal Solution Discussion Select an answer first