2.1 - Implement and Maintain Authentication Methods SSCP Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   What is the primary role of Active Directory Federation Services (ADFS) in an SSO solution?

   • ATo provide a web-based email client for users
   • BTo act as a security token service (STS) that issues claims-based tokens to relying parties
   • CTo manage user passwords and enforce password complexity policies
   • DTo replicate Active Directory data to all domain controllers in the forest
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company's web application needs to allow users to log in with their corporate credentials from a partner organization. The partner organization uses SAML 2.0. The company's application is a single-page application (SPA) that uses OpenID Connect. Which approach should the company take to enable this federation?

   • AModify the partner's SAML IdP to support OpenID Connect.
   • BCreate local accounts for all partner users and sync them via LDAP.
   • CRewrite the SPA to use SAML instead of OpenID Connect.
   • DUse a federation gateway that translates SAML assertions to OpenID Connect tokens.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company wants to implement MFA for its administrators. The administrators are issued company smartphones. The security team is concerned about the risk of push notification fatigue, where users accidentally approve malicious requests. Which MFA method should they implement to mitigate this specific risk?

   • ARequire a number matching challenge in the push notification.
   • BUse a hardware token that displays a TOTP code.
   • CUse a simple push notification that only requires tapping 'Approve'.
   • DSend an SMS OTP to the company smartphone.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A university partners with a cloud-based research platform. The university wants its students and faculty to access the platform using their existing university credentials, without creating new accounts. The platform must not receive the users' passwords. Which federated identity approach should the university implement?

   • AConfigure the platform to use LDAP binds directly against the university's Active Directory over the internet.
   • BSynchronize the university's user database to the platform nightly using a CSV export.
   • CEstablish a SAML 2.0 federation where the university acts as the identity provider and the platform is the service provider.
   • DUse OAuth2 with the password grant type, sending the university credentials to the platform.
   Reveal Solution Discussion Select an answer first