nerdexam
CompTIA

CAS-002 · Question #343

Two separate companies are in the process of integrating their authentication infrastructure into a unified single sign-on system. Currently, both companies use an AD backend and two factor…

The correct answer is D. They should use the username format: [email protected], together with a. When two AD forests share a trust relationship, users authenticate to cross-domain resources using the UPN format ([email protected]) so the authentication layer can route the request to the correct domain.

Technical Integration of Enterprise Components

Question

Two separate companies are in the process of integrating their authentication infrastructure into a unified single sign-on system. Currently, both companies use an AD backend and two factor authentication using TOTP. The system administrators have configured a trust relationship between the authentication backend to ensure proper process flow. How should the employees request access to shared resources before the authentication integration is complete?

Options

  • AThey should logon to the system using the username concatenated with the 6-digit code
  • BThey should logon to the system using the newly assigned global username:
  • CThey should use the username format: LAN\first.lastname together with their original
  • DThey should use the username format: [email protected], together with a

How the community answered

(51 responses)
  • A
    6% (3)
  • B
    2% (1)
  • C
    8% (4)
  • D
    84% (43)

Why each option

When two AD forests share a trust relationship, users authenticate to cross-domain resources using the UPN format ([email protected]) so the authentication layer can route the request to the correct domain.

AThey should logon to the system using the username concatenated with the 6-digit code

Concatenating the username with the 6-digit TOTP code in a single field is not a recognized authentication format and would break both the directory lookup and the TOTP validation flow.

BThey should logon to the system using the newly assigned global username:

Newly assigned global usernames are not yet available because the SSO integration is still in progress and unified accounts have not been provisioned.

CThey should use the username format: LAN\first.lastname together with their original

The legacy NETBIOS format DOMAIN\username does not traverse inter-organizational AD trust boundaries as reliably as UPN and is not suited for cross-forest authentication scenarios.

DThey should use the username format: [email protected], together with aCorrect

Active Directory trust relationships use the UPN suffix to identify which forest should authenticate a given user. The format [email protected] includes the domain suffix that allows the authentication routing layer to forward the request to the correct AD forest, while the user retains their original password and TOTP second factor without requiring new credentials before the integration is complete.

Concept tested: Active Directory cross-domain authentication using UPN format

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-user-principal-names

Topics

#SSO integration#TOTP#Active Directory federation#two-factor authentication

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice