Which of the following is true about an unauthenticated SAMLv2 transaction?

In SAMLv2, the flow for an unauthenticated user starts with the browser sending a request to the Service Provider for a protected resource. Because the user has no active session, the SP cannot fulfill the request and instead redirects the browser to the Identity Provider (IdP) with an authentication request. This SP-initiated flow is the standard starting point for an unauthenticated SAMLv2 transaction.

The browser does not ask the IdP directly for a resource; the IdP is an authentication authority, not a resource provider - it receives the browser only after the SP redirects it.

The browser does not proactively ask the IdP to validate the user; validation is triggered by the SP's redirect after the initial resource request.

The SP does not validate users itself in SAML federation; it delegates authentication to the IdP, which is the entire purpose of the SAML trust relationship.