A user logs into domain A using a PKI certificate on a smartcard protected by an 8 digit PIN. The credential is cached by the authenticating server in domain A. Later, the user attempts to access a…

Authentication describes the process of verifying identity, but the question specifically asks about the mechanism that carries that verified identity claim across domain boundaries, which is a federation concept.

Authorization determines what an authenticated user is permitted to do, not how identity claims are communicated between separate domains.

SAML (Security Assertion Markup Language) is an XML-based standard specifically designed to allow an identity provider to make assertions about an authenticated user to a service provider in a different security domain. The scenario - where the original authenticating server attests to a resource server in domain B that the user is legitimate - precisely describes the SAML assertion flow between an identity provider and a service provider. SAML is the correct answer because it enables cross-domain single sign-on by passing a cryptographically signed assertion rather than re-authenticating the user.

Kerberos uses tickets within a single realm (or trusted realms via referrals), but it does not use the assertion-based model described where one server attests identity to an entirely separate domain's resource server.