nerdexam
CompTIA

SY0-501 · Question #91

A company has three divisions, each with its own networks and services. The company decides to make its secure web portal accessible to all employees utilizing their existing usernames and passwords,

The correct answer is B. The portal will request an authentication ticket from each network that is transitively trusted C. The back-end networks will function as an identity provider and issue an authentication. In a SAML federated authentication scenario, the back-end networks where user accounts reside act as Identity Providers (IdPs), while the web portal acts as the Service Provider (SP) requesting authentication assertions from those IdPs.

Submitted by minji_kr· Mar 4, 2026Security architecture

Question

A company has three divisions, each with its own networks and services. The company decides to make its secure web portal accessible to all employees utilizing their existing usernames and passwords, The security administrator has elected to use SAML to support authentication. In this scenario, which of the following will occur when users try to authenticate to the portal? (Select TWO)

Options

  • AThe portal will function as an identity provider and issue an authentication assertion
  • BThe portal will request an authentication ticket from each network that is transitively trusted
  • CThe back-end networks will function as an identity provider and issue an authentication
  • DThe back-end networks will request authentication tickets from the portal, which will act as the
  • EThe back-end networks will verify the assertion token issued by the portal functioning as the

How the community answered

(27 responses)
  • A
    4% (1)
  • B
    81% (22)
  • D
    7% (2)
  • E
    7% (2)

Why each option

In a SAML federated authentication scenario, the back-end networks where user accounts reside act as Identity Providers (IdPs), while the web portal acts as the Service Provider (SP) requesting authentication assertions from those IdPs.

AThe portal will function as an identity provider and issue an authentication assertion

The portal is the Service Provider (SP) in this scenario, not the Identity Provider; the IdP role belongs to the back-end networks that actually store and validate user credentials.

BThe portal will request an authentication ticket from each network that is transitively trustedCorrect

The portal, acting as the SAML Service Provider, initiates authentication by requesting assertions from each division's identity provider, leveraging transitive trust relationships established through SAML federation to allow cross-domain authentication.

CThe back-end networks will function as an identity provider and issue an authenticationCorrect

The back-end networks host the existing user credentials and therefore function as Identity Providers in the SAML model, issuing signed authentication assertions that confirm the user's identity to the portal (Service Provider) without exposing passwords.

DThe back-end networks will request authentication tickets from the portal, which will act as the

In SAML, the Service Provider (portal) requests assertions from the IdP, not the reverse; back-end networks as IdPs do not request tickets from the portal.

EThe back-end networks will verify the assertion token issued by the portal functioning as the

The back-end networks are the Identity Providers that issue assertion tokens, not entities that verify tokens issued by the portal; the portal has no IdP function in this architecture.

Concept tested: SAML federation roles: Identity Provider vs Service Provider

Source: https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html

Topics

#SAML#federated identity#identity provider#SSO

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice