5.3 - Federated Identity with a Third-Party Service CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A startup has all its user identities in a cloud-based identity provider (e.g., Okta, Azure AD). They want to give their employees access to a new third-party project management tool that supports OIDC. What is the simplest way to enable SSO for this tool?

   • AUse a federation server on-premises to bridge to the cloud IdP.
   • BHave users log in to the tool using their social media accounts.
   • CSet up a separate identity store in the project management tool and manually create accounts.
   • DConfigure the project management tool as an application in the cloud IdP and enable SSO via OIDC.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses a cloud-based IdP and wants to allow its employees to access a third-party application that supports SAML. The company wants to enforce multi-factor authentication (MFA) for this application. Where should the MFA policy be configured?

   • AOn each user's device.
   • BIn the third-party application's own settings.
   • CIn the company's cloud IdP as part of the application's access policy.
   • DIn the network firewall.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization runs its identity management on an on-premises Active Directory (AD) and wants to enable single sign-on for employees to a third-party SaaS application that supports SAML 2.0. The organization does not want to store any passwords in the cloud. What should they implement?

   • ADeploy an on-premises federation server that acts as the identity provider, and configure the SaaS application to trust it via SAML.
   • BCreate a separate account for each employee in the SaaS application and use a password manager.
   • CUse a cloud-based identity provider and sync AD passwords to it.
   • DSet up a VPN between the organization and the SaaS provider so users can access the app directly.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which component is essential when implementing federated identity with an on-premise identity provider?

   • AA VPN connection between the on-premise network and the third-party service's data center
   • BA dedicated hardware security module (HSM) to store all user passwords
   • CA federation server that translates the on-premise authentication into a format accepted by the third-party service
   • DA directory synchronization tool that copies all user accounts to the third-party service
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary function of a trust relationship between an on-premise identity provider and a third-party service?

   • AIt grants the third-party service direct access to the on-premise user database
   • BIt creates a single administrative domain for managing users in both environments
   • CIt allows the third-party service to accept authentication assertions from the on-premise identity provider
   • DIt synchronizes user passwords between the on-premise directory and the third-party service
   Reveal Solution Discussion Select an answer first