2V0-51.23 · Question #81
Drag and Drop Question Drag and drop the SSO Architecture on the left into the diagram on the right. Answer:
The correct answer is Certificate Authority; Enrollment Server; SAML; Connection Server. SSO Architecture: Drag-and-Drop Explanation This question maps the trust and authentication flow in a certificate-based SSO system (commonly seen in VMware Horizon True SSO or similar enterprise VDI architectures). --- The Flow `` [Certificate Authority] → [Enrollment Server] → [
Question
Drag and Drop Question Drag and drop the SSO Architecture on the left into the diagram on the right. Answer:
Exhibit
Answer Area
Drag items
Correct arrangement
- Certificate Authority
- Enrollment Server
- SAML
- Connection Server
Explanation
SSO Architecture: Drag-and-Drop Explanation
This question maps the trust and authentication flow in a certificate-based SSO system (commonly seen in VMware Horizon True SSO or similar enterprise VDI architectures).
The Flow
[Certificate Authority] → [Enrollment Server] → [SAML] → [Connection Server]
Why Each Item Goes Where It Does
1. Certificate Authority (CA) - Position 1 The CA is the root of trust. Everything downstream depends on it. It issues the digital certificates that the rest of the pipeline relies on. Without the CA established first, no component can prove identity or establish trust. It is the anchor of the entire PKI chain.
2. Enrollment Server - Position 2 The Enrollment Server sits directly after the CA because its job is to request and receive short-lived certificates from the CA on behalf of users. When a user authenticates, the Enrollment Server reaches out to the CA to obtain a certificate - this is the bridge between the CA's trust authority and the authentication protocol layer.
3. SAML - Position 3 SAML (Security Assertion Markup Language) carries the authentication assertion - a signed token that says "this user has been verified." It is placed after enrollment because the SAML assertion is only generated after the certificate has been obtained and the identity validated. It packages that proof into a format the Connection Server can consume.
4. Connection Server - Position 4 The Connection Server is the end gateway - what the user ultimately connects through to reach virtual desktops or applications. It receives the SAML assertion, validates it, and grants access. It must be last because it depends on all prior steps completing successfully.
Common Mistakes
| Mistake | Why It's Wrong |
|---|---|
| Placing SAML before Enrollment Server | SAML asserts identity after certificate enrollment; it can't precede it |
| Placing Connection Server before SAML | The Connection Server consumes SAML assertions - it can't act without them |
| Treating CA as optional or middle-layer | The CA is foundational; removing or repositioning it breaks the entire trust chain |
Key mental model: Think of it as a chain of delegation - the CA grants trust, the Enrollment Server operationalizes it, SAML communicates it, and the Connection Server enforces it.
Topics
Community Discussion
No community discussion yet for this question.