CIAM Authentication Methods 2 — Questions and Answers
Question 1: Which authentication protocol uses security assertions in XML format to exchange authentication and authorization data between an identity provider and a service provider?
- OAuth 2.0
- SAML 2.0 (Correct answer)
- OpenID Connect
- Kerberos
Correct answer: SAML 2.0
SAML 2.0 (Security Assertion Markup Language) uses XML-based assertions to convey authentication and authorization information between identity providers and service providers.
Question 2: What is the primary purpose of a TOTP (Time-based One-Time Password) in multi-factor authentication?
- To replace passwords permanently
- To generate a short-lived code synchronized with a time clock (Correct answer)
- To encrypt the user's password during transmission
- To store biometric data securely
Correct answer: To generate a short-lived code synchronized with a time clock
TOTP generates a numeric code derived from a shared secret and the current time, typically valid for 30 seconds, adding a time-sensitive second factor.
Question 3: In certificate-based authentication, what cryptographic artifact does the client present to prove identity?
- A session cookie signed by the server
- A digital certificate containing the client's public key (Correct answer)
- A hashed copy of the client's password
- A SAML assertion from the IdP
Correct answer: A digital certificate containing the client's public key
Certificate-based authentication requires the client to present a digital certificate (e.g., X.509) containing its public key, signed by a trusted Certificate Authority.
Question 4: An organization wants to allow users to log in with their corporate credentials on a third-party SaaS application without sharing passwords. Which federation approach is most appropriate?
- Password vaulting
- SAML-based SSO (Correct answer)
- Basic HTTP authentication
- LDAP direct bind
Correct answer: SAML-based SSO
SAML-based SSO enables federated identity so users authenticate at the corporate IdP and the SaaS SP accepts the assertion, never receiving the user's password.
Question 5: What differentiates step-up authentication from standard MFA?
- Step-up authentication is only used for mobile devices
- Step-up authentication triggers additional factors when elevated risk or privilege is detected (Correct answer)
- Step-up authentication permanently replaces passwords
- Step-up authentication always requires biometrics
Correct answer: Step-up authentication triggers additional factors when elevated risk or privilege is detected
Step-up authentication dynamically requires additional verification factors when a user attempts a higher-risk action or accesses sensitive resources during an existing session.
Question 6: Which of the following best describes a 'possession factor' in multi-factor authentication?
- Something the user knows, like a PIN
- Something the user has, like a hardware token (Correct answer)
- Something the user is, like a fingerprint
- Something the user does, like a gesture
Correct answer: Something the user has, like a hardware token
A possession factor ('something you have') includes physical or virtual items the user owns, such as a hardware token, smart card, or mobile authenticator app.
Question 7: When implementing passwordless authentication using FIDO2/WebAuthn, what is stored on the server side?
- The user's private key
- The user's password hash
- The user's public key and credential ID (Correct answer)
- The user's biometric template
Correct answer: The user's public key and credential ID
In FIDO2/WebAuthn, the server (relying party) stores only the user's public key and credential ID; the private key never leaves the user's authenticator device.
CIAM Authentication Methods 2
Which authentication protocol uses security assertions in XML format to exchange authentication and authorization data between an identity provider and a service provider?