CAS-001 · Question #222
A user logs into domain A using a PKI certificate on a smartcard protected by an 8 digit PIN. The credential is cached by the authenticating server in domain A . Later, the user attempts to access a…
The correct answer is C. SAML. Cross-domain identity attestation using an existing authenticated credential describes the SAML federation model, where an identity provider asserts identity to a service provider in a different domain.
Question
A user logs into domain A using a PKI certificate on a smartcard protected by an 8 digit PIN. The credential is cached by the authenticating server in domain A . Later, the user attempts to access a resource in domain B, This initiates a request to the original authenticating server to somehow attest to the resource server in the second domain that the user is in fact who they claim to be. Which of the following is being described?
Options
- AAuthentication
- BAuthorization
- CSAML
- DKerberos
How the community answered
(31 responses)- A10% (3)
- B19% (6)
- C68% (21)
- D3% (1)
Why each option
Cross-domain identity attestation using an existing authenticated credential describes the SAML federation model, where an identity provider asserts identity to a service provider in a different domain.
Authentication describes the general process of verifying identity, not the specific cross-domain federation protocol being used.
Authorization determines what a verified user is permitted to do, which occurs after identity is established and is not the mechanism described.
SAML (Security Assertion Markup Language) is specifically designed to enable single sign-on across different security domains by having an identity provider issue signed assertions that a relying party in another domain can trust. In this scenario, the authenticating server in domain A acts as the SAML identity provider, issuing an assertion to the resource server in domain B. This cross-domain federation is the defining characteristic of SAML and distinguishes it from protocols scoped to a single realm.
Kerberos uses tickets issued by a KDC within a single realm and, while it supports cross-realm trusts, the scenario's description of PKI certificates and cross-domain attestation aligns with SAML rather than Kerberos.
Concept tested: SAML cross-domain federated identity assertion
Source: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html
Topics
Community Discussion
No community discussion yet for this question.