In single sign-on, the secondary domain needs to trust the primary domain to do which of the following? (Select TWO).

Question

Options

• ACorrectly assert the identity and authorization credentials of the end user.
• BCorrectly assert the authentication and authorization credentials of the end user.
• CProtect the authentication credentials used to verify the end user identity to the secondary domain
• DProtect the authentication credentials used to verify the end user identity to the secondary domain
• EProtect the accounting credentials used to verify the end user identity to the secondary domain for
• FCorrectly assert the identity and authentication credentials of the end user.

• B
  3% (1)
• D
  94% (32)
• E
  3% (1)

Explanation

In Single Sign-On (SSO), the secondary (relying) domain delegates authentication to the primary (identity provider) domain. The secondary domain must trust the primary domain to: (1) correctly assert the identity and authentication credentials of the end user (F) - the primary domain vouches for who the user is and that they have been authenticated; and (2) protect the authentication credentials used to verify the end user identity (D) - the primary domain must securely handle and safeguard those credentials. Authorization is intentionally excluded from the primary domain's responsibility in SSO; each domain (including the secondary) typically manages its own authorization decisions about what an authenticated user can do. Options A and B incorrectly include 'authorization' as part of what the primary domain asserts, and option E incorrectly references 'accounting' credentials, which is not part of the SSO trust model.

No community discussion yet for this question.