A newly hired employee is trying to complete online training. When the employee logs on to the third-party service for training using known-good credentials through a SAML-based mechanism, an error…

Question

Options

• AThe third-party service does not support special characters in passwords.
• BThe new employee's user account is not listed properly by the IdP.
• CThe service provider is not verifying the user account exists in the directory.
• DThe user agent string is not listing the correct information.

• B
  13% (2)
• C
  7% (1)
• D
  80% (12)

Explanation

WARNING: The stated correct answer (D) appears to be incorrect for this scenario. In a SAML-based SSO flow, the Identity Provider (IdP) authenticates the user and issues a signed SAML assertion to the Service Provider (SP). When a newly hired employee encounters an account-related error - even with known-good credentials - the most likely cause is that the employee's account is not yet properly provisioned or configured in the IdP (Answer B). SAML does not transmit passwords to the SP; it transmits assertions about the user. If the IdP has the account misconfigured (wrong attributes, missing group membership, incorrect NameID format), the SP will reject the assertion with an account-level error. Answer D (user agent string) is a browser HTTP header unrelated to account provisioning and would more typically manifest as redirect failures or browser compatibility errors, not account errors. Answer C is also wrong because in SAML the SP deliberately trusts the IdP's assertion and is not expected to independently verify the user against a directory.

No community discussion yet for this question.