Access Control

Which entity in Federated Identity Management is responsible for verifying user credentials?

• Service Provider (SP)
• Identity Provider (IdP)
• Authorization Server
• Resource Owner

What is generated by the Identity Provider after successful user authentication in a Federated Identity Management system?

• An encryption key
• A security token
• A password hash
• A digital certificate

In the context of Federated Identity Management, what role does a Service Provider play?

• Generates tokens
• Verifies user credentials
• Consumes and verifies identity tokens
• Manages user permissions

Which standard is primarily used for authorization in web and mobile applications, allowing third party access without sharing credentials?

• SAML
• SSL
• OAuth 2.0
• OpenID Connect

What distinguishes OpenID Connect from OAuth 2.0?

• OAuth 2.0 provides user authentication while OpenID Connect provides authorization.
• OpenID Connect adds an authentication layer on top of OAuth 2.0’s authorization framework.
• OpenID Connect is less secure than OAuth 2.0.
• OAuth 2.0 uses XML while OpenID Connect uses JSON.

What does SAML primarily facilitate in web based environments?

• Encrypted web traffic
• Exchange of authentication and authorization data
• Secure file transfer
• Password management

Which process does Single SignOn (SSO) simplify for users?

• Password creation
• User registration
• User authentication across multiple applications
• Token generation

How does SSO differ from Federated Identity Management?

• SSO is used for internal authentication processes, while FIM is used for external processes.
• SSO is only applicable to web applications, while FIM can be used for any type of application.
• SSO deals with single organizational boundaries, while FIM spans multiple organizational boundaries.
• FIM deals with encryption, while SSO does not.

Which component in an SSO architecture is primarily responsible for user authentication?

• Service Provider (SP)
• Identity Provider (IdP)
• Authorization Server
• Client Application

What comes after successful authentication in the security process?

• Policy Enforcement
• Authorization
• Access Control
• User Identification