You save $69.98
A SaaS application accepts a correctly signed SAML assertion issued for another application. Which validation is essential?
A signed assertion is not safe to replay at a different service unless its relying-party binding is validated.
A user label cannot establish issuer trust or destination binding.
Trust in an IdP does not make all its assertions valid for every audience.
Transport protection does not override the assertion's own validity bounds.
The SP validates issuer and signature but omits assertion replay protection. What residual attack is plausible?
Cryptographic authenticity alone is not the same as freshness and session binding.
Assertion replay risk depends on presentation, identifier and session checks, not TLS alone.
The relying party must enforce its own session and assertion conditions.
Identity strings do not prove a fresh authorized federated transaction.
What negative test BEST proves correct SAML relying-party binding?
The test isolates audience binding despite a trusted issuer and valid signature.
A positive test cannot reveal acceptance of cross-audience assertions.
Visual branding is not protocol validation.
Display metadata does not test cross-service assertion use.
A payment API accepts any correctly signed OpenID Connect ID token as authorization to transfer funds. The ID token was issued to a browser client, not the API. What change BEST closes this token-confusion flaw?
An OIDC ID token asserts identity to the client; it is not a generic delegated API authorization credential. The resource server must check the intended access-token profile and permissions.
Authentication strength and token signature do not establish that the token was issued for this API or grants funds-transfer scope.
A trusted issuer can mint tokens for several audiences; ignoring audience allows token substitution between clients and resources.
Cookie protection does not transform an identity assertion into scoped API permission or verify transaction ownership.
A payment API now requires valid scoped access tokens instead of OIDC ID tokens. Which further control is appropriate when privileged access must be revoked promptly?
Short-lived tokens and supported revocation/introspection reduce exposure after compromise. Merely checking signature and scopes does not invalidate every unexpired stolen credential.
A previously issued self-contained access token may remain cryptographically valid until expiry unless the issuer/resource server enforces additional revocation.
Bypassing validation increases token substitution and impersonation risk, not revocation assurance.
Token expiration is a security boundary and should not be overridden by a business balance check.
A resource server claims it no longer confuses identity and access tokens. Which authentication/authorization test is MOST decisive?
Negative wrong-token and positive correct-token tests prove both intended-token audience validation and authorization beyond signature verification.
That result demonstrates the original substitution vulnerability remains.
OIDC login verifies client authentication, not protection of the API’s token boundary.
Accepting expired credentials undermines token lifetime enforcement and does not prove correct issuer/audience handling.
An employee is disabled at the corporate identity provider but continues using a SaaS app for weeks under an existing session. Which improvement addresses the gap?
IdP disablement may not terminate a separately issued SaaS session; lifecycle controls must reach the relying party.
Pre-existing sessions can persist after the next SSO authentication is blocked.
Longer sessions extend the revocation exposure window.
Provisioning and authentication are distinct protocols and lifecycles.
The SaaS receives a SCIM deactivation event. Which residual risk still needs assessment?
Deprovisioning events do not always invalidate every bearer credential in every subsystem.
Local application sessions can outlive remote directory state.
Transport certificate maintenance is unrelated to individual session lifecycle.
Federation is legitimate; its revocation and session bounds need correct implementation.
Which test BEST demonstrates federated account termination?
Covers separate login, session and token paths that otherwise escape deprovisioning.
Directory state alone says nothing about active SaaS cookies or tokens.
Account creation does not test account termination.
An annual login test misses the immediate offboarding requirement.
An enterprise creates one custom role per employee and can no longer audit which privileges are sensitive. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
RBAC is easier to govern when roles correspond to stable job functions. Roles can still contain toxic permission combinations and need conflict analysis.
Role explosion makes sensitive permission review and conflict detection harder.
Broad entitlements defeat least privilege and auditable business role boundaries.
Nominal roles do not prevent toxic access conflicts or overbroad authorization.
The organization implemented the response to this scenario: An enterprise creates one custom role per employee and can no longer audit which privileges are sensitive. The approved response was: Normalize business roles with periodic review and separations, reserving exceptions for specific needs. Which statement MOST accurately identifies a remaining risk or constraint?
RBAC is easier to govern when roles correspond to stable job functions. Comparable staff share reviewed role baselines and prohibited role combinations are blocked.
Role design still needs separation-of-duties and toxic-combination checks.
Large numbers of unique roles may obscure equivalence and review ownership.
Role-to-job alignment changes and requires lifecycle reassessment.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
