nerdexam
(ISC)2

CISSP · Question #876

Single sign-on (SSO) for federated identity management (FIM) must be implemented and managed so that authorization mechanisms protect access to privileged information using OpenID Connect (OIDC) token

The correct answer is D. The access token or assertion should be encrypted to ensure privacy.. To protect access to privileged information using OpenID Connect tokens or SAML assertions in a federated identity management setup, the best method is to encrypt these tokens or assertions to ensure their confidentiality and privacy.

Submitted by certguy· Mar 5, 2026Identity and Access Management

Question

Single sign-on (SSO) for federated identity management (FIM) must be implemented and managed so that authorization mechanisms protect access to privileged information using OpenID Connect (OIDC) token or Security Assertion Markup Language (SAML) assertion. What is the BEST method to use to protect them?

Options

  • APass data in a bearer assertion, only signed by the identity provider.
  • BTokens and assertion should use base64 encoding to assure confidentiality.
  • CUse a challenge and response mechanism such as Challenge Handshake Authentication
  • DThe access token or assertion should be encrypted to ensure privacy.

How the community answered

(39 responses)
  • A
    8% (3)
  • B
    13% (5)
  • C
    31% (12)
  • D
    49% (19)

Why each option

To protect access to privileged information using OpenID Connect tokens or SAML assertions in a federated identity management setup, the best method is to encrypt these tokens or assertions to ensure their confidentiality and privacy.

APass data in a bearer assertion, only signed by the identity provider.

Signing an assertion verifies its integrity and authenticity but does not protect the privacy or confidentiality of the data it carries, as the content remains readable.

BTokens and assertion should use base64 encoding to assure confidentiality.

Base64 encoding is a method of data representation, not a security mechanism, and does not provide confidentiality or privacy as the encoded data is easily reversible.

CUse a challenge and response mechanism such as Challenge Handshake Authentication

Challenge-response mechanisms are primarily used for authentication of an entity, not for ensuring the confidentiality of the contents of an already issued authorization token or assertion.

DThe access token or assertion should be encrypted to ensure privacy.Correct

Encrypting the access token or SAML assertion ensures the confidentiality and privacy of the sensitive information contained within them. This prevents unauthorized parties from reading the token's content, thereby protecting the data used for authorization to privileged resources.

Concept tested: Confidentiality of identity tokens via encryption

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview

Topics

#Federated identity#SSO#SAML#OIDC#Token security#Encryption

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISSP Practice