M3.2 module quiz
Ten questions. 80% to pass (8 of 10). Open book, unlimited retakes.
Answers are collapsed under each question. Answer first, then check.
Q1
SAML configuration is stored:
A. In the frontend build, so that the assertion can be validated directly in the browser
B. In the IdP only, fetched fresh on each sign-in
C. In a YAML config file deployed with the service
D. In the customer’s tenant database encrypted at rest, with the certificate in the secret manager
Show answer
Correct: D. Validation happens at the gateway on assertion arrival: signature against the stored cert, timestamps with a clock-skew tolerance, audience against the entity ID, then attribute extraction.
Q2
“Invalid signature” on SSO login is which diagnostic category?
A. Clock and timing
B. Metadata drift
C. Certificate
D. User-side
Show answer
Correct: C. Either the IdP cert expired or it was rotated without the new one being loaded. It is IdP-side, and it is the most common category because it is a silent, dated failure.
Q3
The four SSO diagnostic categories are:
A. Certificate, metadata drift, clock and timing, user-side
B. Network, auth, config and user error
C. Client, server, IdP and SP faults
D. Transient, permanent, config and permission faults
Show answer
Correct: A. Classifying before debugging is what turns an SSO outage from an open-ended investigation into four checks.
Q4
SAML configuration fields are typically populated by:
A. Manual entry of every field by an admin
B. Fetching the IdP’s metadata URL during setup
C. The identity provider’s own admin API
D. A ZopNight support ticket raised at setup
Show answer
Correct: B. The metadata URL is the one to use. Pasting metadata XML directly is supported when the IdP does not expose a URL.
Q5
OAuth versus SAML for enterprise SSO:
A. They are equivalent in security terms, so the choice comes down entirely to what the customer’s IdP supports
B. SAML is deprecated and kept only for existing enterprise customers
C. OAuth cannot integrate with a corporate directory at all
D. OAuth is the lightweight default and needs a domain allowlist; SAML carries the stronger enterprise controls
Show answer
Correct: D. Multiple methods can coexist for one organisation, which matters during a migration between them.
Q6
The domain allowlist on OAuth exists to:
A. Improve sign-in performance measurably
B. Route users to the right organisation
C. Prevent anyone with a Google or GitHub account from signing in
D. Satisfy the identity provider’s own configuration requirements
Show answer
Correct: C. Without it, “sign in with Google” means anyone with a Google account, which is not what the org intended by enabling it.
Q7
Clock skew tolerance on SAML assertion validation is:
A. A few minutes
B. Zero; timestamps must match exactly
C. One hour
D. Configurable per org
Show answer
Correct: A. A five-minute tolerance absorbs normal drift. Zero tolerance would make SSO fail intermittently for reasons nobody could reproduce.
Q8
SAML is configured:
A. Once per organisation
B. Per email domain
C. Per user
D. Per cloud account
Show answer
Correct: B. Which is what lets a company with several email domains route each to the right IdP, and what makes multi-domain setup a first-class case rather than a workaround.
Q9
A vocabulary distinction worth keeping precise:
A. OAuth 2.0 is authorization; OIDC is the authentication layer on top of it
B. SAML and OAuth 2.0 are both purely authentication protocols at heart
C. OIDC replaces SAML entirely in modern estates
D. SAML is a subset of the OAuth specification
Show answer
Correct: A. Calling OAuth “an SSO authentication method” is loose, and the imprecision matters when writing a security document someone else will audit.
Q10
Escalating an unresolved SSO failure to support should include:
A. The user’s password
B. The trace ID
C. A screenshot only
D. The IdP’s private key
Show answer
Correct: B. The trace ID is what connects the failed assertion to the gateway’s own record of it, which is the difference between a reproducible report and a description.