nerdexam
CompTIA

CAS-002 · Question #167

In single sign-on, the secondary domain needs to trust the primary domain to do which of the following? (Select TWO).

The correct answer is D. Protect the authentication credentials used to verify the end user identity to the secondary F. Correctly assert the identity and authentication credentials of the end user. In SSO, the secondary domain must trust the primary domain to correctly assert user identity and authentication credentials, and to protect those credentials from unauthorized disclosure.

Enterprise Security

Question

In single sign-on, the secondary domain needs to trust the primary domain to do which of the following? (Select TWO).

Options

  • ACorrectly assert the identity and authorization credentials of the end user.
  • BCorrectly assert the authentication and authorization credentials of the end user.
  • CProtect the authentication credentials used to verify the end user identity to the secondary
  • DProtect the authentication credentials used to verify the end user identity to the secondary
  • EProtect the accounting credentials used to verify the end user identity to the secondary
  • FCorrectly assert the identity and authentication credentials of the end user.

How the community answered

(31 responses)
  • A
    3% (1)
  • D
    94% (29)
  • E
    3% (1)

Why each option

In SSO, the secondary domain must trust the primary domain to correctly assert user identity and authentication credentials, and to protect those credentials from unauthorized disclosure.

ACorrectly assert the identity and authorization credentials of the end user.

This option incorrectly pairs identity with authorization credentials - in SSO the primary domain asserts authentication (who the user is), while authorization decisions are typically made locally by each domain based on their own policies.

BCorrectly assert the authentication and authorization credentials of the end user.

Authorization credentials are managed and enforced locally by each domain in standard SSO implementations; the secondary domain does not rely on the primary to assert what the user is permitted to do.

CProtect the authentication credentials used to verify the end user identity to the secondary

This option appears nearly identical to D but contains a subtle wording difference in the truncated portion that introduces an inaccuracy about the domain relationship or scope of the credential protection obligation.

DProtect the authentication credentials used to verify the end user identity to the secondaryCorrect

The secondary domain must trust the primary domain to safeguard the authentication credentials used to verify user identity, ensuring those credentials are not exposed or misused during the cross-domain authentication handoff.

EProtect the accounting credentials used to verify the end user identity to the secondary

Accounting credentials relate to usage tracking and auditing rather than identity verification, and the secondary domain's trust relationship in SSO does not involve accounting credential assertion.

FCorrectly assert the identity and authentication credentials of the end user.Correct

The secondary domain must also trust that the primary domain correctly asserts both the user's identity and their authentication credentials so that access decisions in the secondary domain are based on accurate, verified, and unaltered information.

Concept tested: SSO cross-domain trust for authentication and identity assertion

Source: https://learn.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol

Topics

#single sign-on#domain trust#federated authentication#credential assertion

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice