A company wants to allow its employees to access a partner's application using their corporate credentials. The partner's application is configured to trust the company's cloud IdP. What is the user experience?

Users must use a VPN to access the partner's application.

Users must create a separate account in the partner's application and use different credentials.

Users authenticate to their company IdP and are redirected to the partner's application with a token, without entering credentials again.

Users authenticate directly to the partner's application using their corporate credentials.

A company has on-premises Active Directory and uses a cloud-based IdP for SaaS apps. They want to enable SSO for all apps, but the security team insists that authentication for on-premises resources must remain on-premises. What is the best design?

Use a single on-premises IdP for everything and disable the cloud IdP.

Move all authentication to the cloud IdP and have it authenticate for on-premises apps.

Keep two separate identity stores with no synchronization.

Use directory synchronization to replicate identities to the cloud IdP, but keep authentication for on-premises apps on the on-premises IdP, and use federation between the two for cloud apps.

A company uses a cloud-based IdP and wants to allow external partners to access a specific application. The partners use various IdPs (some SAML, some OIDC). The security team requires that all external access be governed by the company's conditional access policies. What is the best way to achieve this?

Create a separate account for each partner user in the company's IdP.

Allow each partner to directly access the application without going through the company's IdP.

Set up a federation server on-premises to bridge all partner IdPs.

Use the cloud IdP's external identity features to create guest users and configure conditional access policies for them.

An organization uses an on-premises identity provider (IdP) and wants to allow its employees to access a partner's web application. The partner's application supports SAML. What must be configured to enable this federation?

A trust relationship between the organization's IdP and the partner's application, with the organization's IdP issuing SAML assertions.

A VPN tunnel between the two organizations so users can access the application directly.

A shared password database between the two organizations.

A direct database connection between the organization's Active Directory and the partner's application.

A company has on-premises Active Directory and also uses a cloud-based identity provider for SaaS applications. They want to enable single sign-on so that users authenticate once and access both on-premises resources and cloud apps. What is the recommended approach?

Maintain two separate identity stores and require users to log in separately to each environment.

Use a single cloud IdP for everything and ignore on-premises AD.

Migrate all on-premises resources to the cloud and decommission AD.

Set up directory synchronization between on-premises AD and the cloud IdP, and establish federation between the two.

Certified Information Systems Security Professional

Domain 5Objective 3

5.3 - Federated Identity with a Third-Party Service CISSP Practice Questions (Page 2)

Part of the Identity and Access Management (IAM) domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

13%of the exam

Questions 6–10

6application · medium
A company wants to allow its employees to access a partner's application using their corporate credentials. The partner's application is configured to trust the company's cloud IdP. What is the user experience?
Select an answer first
7expert · hard
A company has on-premises Active Directory and uses a cloud-based IdP for SaaS apps. They want to enable SSO for all apps, but the security team insists that authentication for on-premises resources must remain on-premises. What is the best design?
Select an answer first
8expert · hard
A company uses a cloud-based IdP and wants to allow external partners to access a specific application. The partners use various IdPs (some SAML, some OIDC). The security team requires that all external access be governed by the company's conditional access policies. What is the best way to achieve this?
Select an answer first
9application · medium
An organization uses an on-premises identity provider (IdP) and wants to allow its employees to access a partner's web application. The partner's application supports SAML. What must be configured to enable this federation?
Select an answer first
10application · medium
A company has on-premises Active Directory and also uses a cloud-based identity provider for SaaS applications. They want to enable single sign-on so that users authenticate once and access both on-premises resources and cloud apps. What is the recommended approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.