When authenticating over HTTP using SAML, which of the following is issued to the authenticating user?

A symmetric key is used for encrypting data or sessions and is not what SAML issues to the authenticating user as a result of the authentication event.

'PKI ticket' is not a standard term in SAML or PKI specifications - Kerberos issues tickets, and PKI issues certificates, but SAML does not issue a 'PKI ticket.'

An X.509 certificate is a PKI artifact used to verify identities and sign SAML assertions, but it is not issued to the end user as the output of SAML authentication.

In SAML, after successful authentication the Identity Provider generates and signs an assertion (also called an assertion ticket or SAML token) that contains the user's identity and attributes. This assertion is transmitted to the Service Provider - typically via HTTP redirect or POST binding - and serves as the portable, time-limited proof of authentication across federated domains.