In which scenario would you choose SAML-based SSO over Kerberos-based SSO?

Question

Options

• AWhen you need to provide transparent authentication for Windows devices.
• BWhen you want to integrate with an external vendor IdP like Okta or PING.
• CWhen you need to support multi-factor authentication using RSA SecurID.
• DWhen you want to enable single logout (SLO) functionality.

• A
  14% (5)
• B
  75% (27)
• C
  8% (3)
• D
  3% (1)

Explanation

B is correct because SAML (Security Assertion Markup Language) was designed specifically for federated identity across organizational boundaries - it's the standard protocol used by cloud-based Identity Providers like Okta, PingFederate, and Azure AD to pass authentication assertions between an IdP and a service provider over the web.

Why the distractors are wrong:

• A (Windows transparent auth): This is Kerberos's home turf - it integrates natively with Active Directory and provides silent, ticket-based authentication to Windows domain-joined devices without user prompts.
• C (RSA SecurID MFA): Both SAML and Kerberos can support MFA; RSA SecurID is not exclusive to either, so this doesn't differentiate them.
• D (Single Logout): SAML does support SLO, but so does Kerberos (via ticket invalidation). SLO alone is not a reason to choose SAML over Kerberos.

Memory tip: Think "SAML = cross-domain, cloud, external vendors" vs. "Kerberos = internal Windows/AD networks." If the question mentions a third-party IdP or web federation, SAML is almost always the answer.

No community discussion yet for this question.