easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A large financial organization is migrating its…
A large financial organization is migrating its on-premises authentication infrastructure to a cloud-based identity provider (IdP) to support a hybrid workforce. Currently, on-premises Active Directory is used with smart cards for authentication. The cloud IdP will support SAML 2.0 and OAuth 2.0. The security team requires that all authentication to cloud applications be protected by hardware-backed keys and that user credentials never leave the on-premises network. The solution must also support FIDO2 authentication for passwordless logins. During a pilot, users report that after authenticating to the cloud IdP using their smart cards, they are prompted again for credentials when accessing certain cloud applications. The logs show that the cloud IdP is issuing multiple authentication requests to the on-premises AD Federation Services (AD FS). The CISO is concerned about performance and security of repeated authentication. As a security architect, what is the best course of action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure AD FS to pass through the smart card certificate to the cloud IdP and enable seamless SSO by using the certificate as a security token.
Configuring AD FS to pass through the smart card certificate to the cloud IdP allows the cloud IdP to accept the certificate as a valid security token, enabling seamless SSO. This eliminates repeated authentication prompts by establishing a trust relationship between AD FS and the cloud IdP. It keeps credentials on-premises and supports hardware-backed keys (smart cards) and FIDO2 authentication. Option A is wrong because deploying an HSM with AD FS improves key security but does not solve the repeated authentication chaining problem; the cloud IdP still needs to trust the token. Option B is wrong because caching tokens on a reverse proxy introduces security risks (e.g., token theft) and does not address the trust issue. Option C is wrong because conditional access policies based on device compliance do not prevent the authentication chaining; the cloud IdP will still require authentication from AD FS for non-compliant devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a hardware security module (HSM) on-premises and integrate it with AD FS to perform certificate-based authentication and issue short-lived tokens.
Why it's wrong here
Short-lived tokens may reduce re-authentication frequency but do not solve the root cause of the cloud IdP not accepting the AD FS token.
- ✗
Implement a reverse proxy to cache authentication tokens and replay them to cloud applications.
Why it's wrong here
Caching tokens on a reverse proxy is insecure and does not establish trust between the cloud IdP and AD FS.
- ✗
Implement a conditional access policy in the cloud IdP to skip authentication for trusted devices based on device compliance.
Why it's wrong here
Device compliance policies do not address the authentication chaining problem between AD FS and the cloud IdP.
- ✓
Configure AD FS to pass through the smart card certificate to the cloud IdP and enable seamless SSO by using the certificate as a security token.
Why this is correct
Passing the certificate allows the cloud IdP to directly authenticate the user without additional prompts, leveraging hardware-backed keys.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.