In a SAML 2.0 web single sign-on flow between an enterprise identity provider and a SaaS application, which party issues the signed assertion that states who the user is, and which party consumes it to grant access?
AThe identity provider issues the signed assertion, and the service provider consumes it to grant access.check_circle Correct
BThe service provider issues the signed assertion, and the identity provider consumes it to grant access.
CThe user agent issues the signed assertion, and the identity provider consumes it to grant access.
DA cloud access security broker issues the signed assertion, and the service provider consumes it to grant access.
Identify that in SAML the identity provider issues signed assertions and the service provider consumes them to authorise access. SAML federation splits trust: the identity provider performs authentication and asserts identity through a signed XML assertion, and the service provider relies on that signature to make an access decision without holding the user credentials itself.
Why A is correct: In SAML the identity provider authenticates the user and issues a digitally signed assertion; the service provider (the relying SaaS application) validates that assertion and grants access, which is the correct division of roles.
Why B is wrong: This reverses the two roles, a common confusion; the service provider never issues the assertion, it only trusts and validates one produced by the identity provider.
Why C is wrong: The browser only relays messages between the parties; it cannot sign an assertion because it does not hold the identity provider signing key, so this is wrong.
Why D is wrong: A CASB enforces policy and gives visibility over cloud use, but it is not the SAML authority that mints assertions, so naming it as the issuer is incorrect.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
It replaces OAuth 2.0 authorisation with a certificate-based mutual TLS handshake for every request.
errorWhy it is wrong: Mutual TLS is a separate transport-layer control that can accompany either protocol; OpenID Connect does not replace the OAuth authorisation model with it, so this misstates the addition.
A hardware security module hosting the tenant encryption keys.
errorWhy it is wrong: An HSM protects and manages cryptographic keys, but it does not discover shadow IT or enforce policy across multiple SaaS applications, so it does not meet the requirement.
Enable the SaaS application's built-in password policy and set accounts to expire automatically ninety days after the last successful sign-in.
errorWhy it is wrong: An inactivity expiry eventually disables dormant accounts but leaves a long window after departure and does not give the single sign-on the security lead asked for.