Which statement correctly describes a feature of SAML authentication?

Question

Options

• ASAML authentication performs incremental directory database replication between partners.
• BSAML can be configured in SAML identity provider (IdP) or SAML service provider (SP) roles on
• CCitrix ADC configured with the SAML service provider (SP) role needs to have access to the
• DSAML authentication uses the common LDAP ports, reducing the required port numbers between
• EOnly encrypted user credentials are passed on the identity provider (IdP) and service provider (SP)

• B
  89% (17)
• D
  5% (1)
• E
  5% (1)

Explanation

Option B is correct because SAML is a federated authentication framework built around two distinct roles: the Identity Provider (IdP), which authenticates users and issues XML-based assertions, and the Service Provider (SP), which consumes those assertions to grant access. Citrix ADC supports both roles, making it highly flexible in enterprise SSO deployments.

Why the distractors are wrong:

• A - SAML has no replication function; directory replication is an Active Directory/LDAP concept entirely unrelated to SAML.
• C - This reverses SAML's core benefit: the SP deliberately does not need access to the directory - that's the IdP's job. The SP trusts the IdP's signed assertion without touching the directory.
• D - SAML communicates over HTTPS (port 443), not LDAP ports (389/636). SAML replaces or augments LDAP-based auth; it doesn't share its ports.
• E - SAML does not pass user credentials at all. It passes signed XML assertions (tokens confirming identity/attributes). The password stays at the IdP and is never forwarded to the SP.

Memory tip: Think of SAML as a passport system - the IdP is the government that issues the passport (assertion), and the SP is the border agent that trusts it. Citrix ADC can be either the government or the border agent, and importantly, the border agent never sees your actual birth certificate (credentials).

No community discussion yet for this question.