CAS-002 · Question #894
Company XYZ finds itself using more cloud-based business tools, and password management is becoming onerous. Security is important to the company; as a result, password replication and shared…
The correct answer is A. Establish a cloud-based authentication service that supports SAML. SAML-based federated authentication provides centralized identity management with distributed login and has broad compatibility across SaaS vendors, eliminating the need for password replication or shared accounts.
Question
Company XYZ finds itself using more cloud-based business tools, and password management is becoming onerous. Security is important to the company; as a result, password replication and shared accounts are not acceptable. Which of the following implementations addresses the distributed login with centralized authentication and has wide compatibility among SaaS vendors?
Options
- AEstablish a cloud-based authentication service that supports SAML.
- BImplement a new Diameter authentication server with read-only attestation.
- CInstall a read-only Active Directory server in the corporate DMZ for federation.
- DAllow external connections to the existing corporate RADIUS server.
How the community answered
(28 responses)- A93% (26)
- C4% (1)
- D4% (1)
Why each option
SAML-based federated authentication provides centralized identity management with distributed login and has broad compatibility across SaaS vendors, eliminating the need for password replication or shared accounts.
SAML (Security Assertion Markup Language) is the dominant open standard for exchanging authentication and authorization data between an identity provider (IdP) and service providers (SPs), which is exactly the federated model SaaS vendors implement. It enables SSO where users authenticate once at the central IdP and receive signed assertions accepted by SaaS providers, eliminating password replication. SAML is natively supported by the vast majority of SaaS vendors including Salesforce, Google Workspace, and Microsoft 365.
Diameter is a AAA protocol designed for telecom network access (LTE, EAP), not for SaaS application federation, and has no meaningful adoption among SaaS identity providers.
Placing a read-only AD instance in the DMZ exposes the directory to the internet and does not inherently provide SAML-based federation without additional federation services such as AD FS.
RADIUS is designed for network access authentication (802.1X, VPN, dial-up) and lacks the assertions-based federation model required for SaaS SSO compatibility.
Concept tested: SAML federated identity for SaaS SSO
Source: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html
Topics
Community Discussion
No community discussion yet for this question.