nerdexam
CompTIA

CAS-002 · Question #254

Which of the following BEST explains SAML?

The correct answer is A. A security attestation model built on XML and SOAP-based services, which allows for the. SAML is an XML and SOAP-based security standard that exchanges assertions about identity and attributes between an identity provider and a service provider to enable cross-domain SSO.

Enterprise Security

Question

Which of the following BEST explains SAML?

Options

  • AA security attestation model built on XML and SOAP-based services, which allows for the
  • BAn XML and SOAP-based protocol, which enables the use of PKI for code signing and SSO
  • CA security model built on the transfer of assertions over XML and SOAP-based protocols,
  • DA security verification model built on SSO and SSL-based services, which allows for the

How the community answered

(52 responses)
  • A
    90% (47)
  • B
    6% (3)
  • C
    2% (1)
  • D
    2% (1)

Why each option

SAML is an XML and SOAP-based security standard that exchanges assertions about identity and attributes between an identity provider and a service provider to enable cross-domain SSO.

AA security attestation model built on XML and SOAP-based services, which allows for theCorrect

SAML (Security Assertion Markup Language) is correctly described as a security attestation model that uses XML for data encoding and SOAP-based web services as its transport, allowing identity providers to issue assertions that service providers consume to grant access without requiring separate credential entry.

BAn XML and SOAP-based protocol, which enables the use of PKI for code signing and SSO

SAML does not enable PKI for code signing; code signing is a separate PKI function unrelated to SAML's purpose of conveying authentication and attribute assertions.

CA security model built on the transfer of assertions over XML and SOAP-based protocols,

While SAML does transfer assertions over XML, this choice mischaracterizes the protocol by omitting the SOAP transport layer and the role of the identity provider/service provider trust relationship.

DA security verification model built on SSO and SSL-based services, which allows for the

SAML is not SSL-based; it is transport-agnostic and relies on XML/SOAP, not SSL, as its core mechanism - SSL may be used as an underlying transport but is not definitional to SAML.

Concept tested: SAML architecture and XML-based assertion exchange

Source: https://docs.oasis-open.org/security/saml/v2.0/saml-tech-overview-2.0-cd-02.html

Topics

#SAML#SSO#XML#federated identity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice