M4.2 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
SAML configuration is stored:
A. In the frontend build, so that the assertion can be validated directly in the browser
B. In the IdP only, fetched fresh on each sign-in
C. In a YAML config file deployed with the service
D. In ZopNight’s external auth service, which also validates each assertion
Show answer
Correct: D. The auth service stores each per-domain config and validates the assertion; ZopNight itself does not. The ZopNight gateway only forwards sign-in traffic to it.
Q2
“Invalid signature” on SSO login is which diagnostic category?
A. Clock and timing
B. Metadata drift
C. Certificate
D. User-side
Show answer
Correct: C. Either the IdP cert expired or it was rotated without the new one being loaded. It is IdP-side, and it is the most common category because it is a silent, dated failure.
Q3
The four SSO diagnostic categories are:
A. Certificate, metadata drift, clock and timing, user-side
B. Network, auth, config and user error
C. Client, server, IdP and SP faults
D. Transient, permanent, config and permission faults
Show answer
Correct: A. Classifying before debugging is what turns an SSO outage from an open-ended investigation into four checks.
Q4
Who creates a customer’s SAML configuration?
A. Any org Admin, on a SAML page in the org’s settings
B. ZopDev staff, from the values the customer sends
C. The IdP, pushing it through its own admin API
D. The first user who signs in from that domain
Show answer
Correct: B. There is no SAML settings page in a customer org. The customer sends the email domain, Azure AD tenant ID, metadata URL and cert thumbprint; ZopDev creates the per-domain record, and the customer tests sign-in before it goes active.
Q5
OAuth versus SAML for enterprise SSO:
A. They are equivalent in security terms, so the choice comes down entirely to what the customer’s IdP supports
B. SAML is deprecated and kept only for existing enterprise customers
C. OAuth cannot integrate with a corporate directory at all
D. OAuth is the lightweight default, gated by org membership; SAML carries the stronger enterprise controls
Show answer
Correct: D. Multiple methods can coexist for one organisation, which matters during a migration between them.
Q6
Google sign-in is on for every org. What stops a stranger with a Google account from seeing your org’s data?
A. A rate limit on brand-new sign-ups
B. The identity provider’s consent screen
C. Org membership, which only an Admin grants
D. A domain allowlist the org Admin configures
Show answer
Correct: C. Anyone can sign in, but a non-member has no organisation, so onboarding creates a separate one for them. There is no domain allowlist; the member list in Settings → Organization is the control.
Q7
A SAML sign-in fails. Where are you most likely to find the specific reason?
A. In the identity provider’s own sign-in logs
B. In your org’s Audit Logs page in ZopNight
C. In ZopNight’s login page error message text
D. In the role and team settings for that user
Show answer
Correct: A. ZopNight does not validate SAML; its external sign-in service and the IdP do. The login page shows only a generic message, and failed sign-ins never reach your org’s audit log, so the IdP’s sign-in logs are where the specific reason shows up.
Q8
SAML is configured:
A. Once per organisation
B. Per email domain
C. Per user
D. Per cloud account
Show answer
Correct: B. Which is what lets a company with several email domains route each to the right IdP, and what makes multi-domain setup a first-class case rather than a workaround.
Q9
A vocabulary distinction worth keeping precise:
A. OAuth 2.0 is authorization; OIDC is the authentication layer on top of it
B. SAML and OAuth 2.0 are both purely authentication protocols at heart
C. OIDC replaces SAML entirely in modern estates
D. SAML is a subset of the OAuth specification
Show answer
Correct: A. Calling OAuth “an SSO authentication method” is loose, and the imprecision matters when writing a security document someone else will audit.
Q10
Escalating an unresolved SSO failure to support should include:
A. The user’s password, so support can retry the sign-in
B. The time, the user’s email and the exact error text
C. A screenshot of the login page and nothing more
D. The IdP’s private key, so support can re-sign the assertion
Show answer
Correct: B. Sign-in runs in ZopNight’s external auth service and does not appear in your org’s audit log, so the time, the user’s email and the exact error shown are what lets support find the failed attempt.