A technician receives a call from Joe, a user, who is unable to log into any of the company's SaaS application. The applications are provided by multiple vendors. Joe reports his credentials were…

Question

Options

• AThere is an error with the federation service.
• BThe user's account is locked out.
• CThe user's security token has expired.
• DThe user's personal certificate has expired.

• A
  5% (1)
• B
  5% (1)
• C
  11% (2)
• D
  79% (15)

Explanation

Joe can log into locally hosted applications but not SaaS applications from multiple vendors. The critical clue is that the problem is specific to Joe (not all users) and specific to SaaS/external apps (not local ones). This points to an expired personal certificate, which is used for client certificate-based authentication to external/cloud services.

• A (Federation service error): A federation service (SAML IdP / ADFS) failure would affect all users trying to access SaaS apps, not just Joe. Since only Joe is affected, this is an infrastructure-level cause that doesn't fit.
• B (Account locked out): A locked account would prevent Joe from logging in to any application - local or SaaS - using those credentials. Since local apps still work, this is ruled out.
• C (Security token expired): An expired security token typically triggers a re-authentication prompt and is quickly resolved by re-authenticating. It would not persistently block access across multiple vendors.
• D (Personal certificate expired) : Many SaaS solutions require client certificate authentication for external access, while local applications may use Kerberos or NTLM (password/integrated auth). When Joe's personal certificate expires, external cert-based authentication fails across all SaaS apps, but local apps relying on password credentials continue to work.

No community discussion yet for this question.