Which two types of SSO functionality are available on the Cisco ASA without any external SSO servers? (Choose two.)

Question

Options

• ASAML
• BNTLM
• CKerberos
• DOAuth 2.0
• EHTTP Basic

• B
  91% (20)
• C
  5% (1)
• D
  5% (1)

Explanation

Note: Although only 'B' is listed in the provided answer key, this is a 'choose two' question. The two correct answers are B (NTLM) and E (HTTP Basic), as both can function on the Cisco ASA natively without any external SSO server.

The Cisco ASA supports multiple SSO mechanisms for its clientless WebVPN portal. The key distinction here is which methods the ASA can execute entirely on its own versus which require an external server:

• NTLM (B – CORRECT): NT LAN Manager is a challenge-response authentication protocol. The ASA can natively issue NTLM challenges to a user's browser and validate the response without needing an external NTLM or Active Directory server. The ASA handles the full exchange internally.
• HTTP Basic (E – CORRECT): HTTP Basic authentication is the simplest credential-passing mechanism. The ASA supports it natively-it presents a browser credential prompt and validates the username/password locally or against a locally configured authentication database without requiring any external SSO infrastructure.

Why the other options are wrong:

• SAML (A): Requires an external Identity Provider (IdP) such as Okta, Azure AD, or ADFS to handle assertions.
• Kerberos (C): Requires a Key Distribution Center (KDC), typically a Windows Domain Controller, to issue and validate service tickets.
• OAuth 2.0 (D): Requires an external Authorization Server to issue tokens; the ASA cannot fulfill this role itself.

No community discussion yet for this question.