nerdexam
CompTIA

CAS-003 · Question #194

A bank provides single sign on services between its internally hosted applications and externally hosted CRM. The following sequence of events occurs: 1. The banker accesses the CRM system, a…

The correct answer is A. Service provider initiated SAML 2.0. In this flow, the banker initiates the session by accessing the CRM system (the Service Provider), which then redirects back to the bank's internal identity systems (the Identity Provider) to authenticate the user. Because the authentication flow was triggered by the Service…

Technical Integration of Enterprise Security

Question

A bank provides single sign on services between its internally hosted applications and externally hosted CRM. The following sequence of events occurs: 1. The banker accesses the CRM system, a redirect is performed back to the organization's internal systems. 2. A lookup is performed of the identity and a token is generated, signed and encrypted. 3. A redirect is performed back to the CRM system with the token. 4. The CRM system validates the integrity of the payload, extracts the identity and performs a lookup. 5. If the banker is not in the system and automated provisioning request occurs. 6. The banker is authenticated and authorized and can access the system. This is an example of which of the following?

Options

  • AService provider initiated SAML 2.0
  • BIdentity provider initiated SAML 1.0
  • COpenID federated single sign on
  • DService provider initiated SAML 1.1

How the community answered

(28 responses)
  • A
    57% (16)
  • B
    25% (7)
  • C
    11% (3)
  • D
    7% (2)

Explanation

In this flow, the banker initiates the session by accessing the CRM system (the Service Provider), which then redirects back to the bank's internal identity systems (the Identity Provider) to authenticate the user. Because the authentication flow was triggered by the Service Provider rather than the Identity Provider, this is called Service Provider (SP) initiated SSO. The Identity Provider then generates, signs, and encrypts a SAML assertion (token) and sends it back to the CRM. The fact that automated provisioning occurs and the token is signed/encrypted aligns with the SAML 2.0 specification (SAML 1.x lacked many of these capabilities). OpenID uses a different protocol and token format, ruling out option C.

Topics

#SAML 2.0#SSO#identity federation#service provider initiated

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice