CV0-004 Security Practice Question
A cloud administrator needs to provide external partners with access to a cloud application using their existing corporate credentials. Which federation protocol should be used?
⚠ Common exam trap
The trap is selecting LDAP or Kerberos because they are familiar authentication technologies; candidates overlook that federation across organizational boundaries to a cloud app specifically requires SAML (or OIDC), not directory or network authentication protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAML
SAML (Security Assertion Markup Language) is the standard federation protocol for web-based single sign-on, allowing external partners to authenticate with their own corporate identity provider and access a cloud application via trust relationships. It exchanges XML-based assertions between an identity provider and a service provider. This matches the requirement of using existing corporate credentials for external access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RADIUS
Why it's wrong here
RADIUS authenticates users against a central server but does not exchange signed assertions about identity between organisations, so partners' corporate credentials cannot be trusted. It is tempting because RADIUS is widely used for network access authentication, and would fit if partners authenticated directly against the administrator's own directory.
- ✗
Kerberos
Why it's wrong here
Kerberos relies on a shared realm and key distribution centre, so partners outside that realm cannot present tickets the application would accept. It is tempting because Kerberos does provide single sign-on within a domain, and would be correct for internal users authenticating inside the same Windows environment.
- ✓
SAML
Why this is correct
SAML exchanges signed assertions between the partner's identity provider and the cloud application, letting partners authenticate with existing corporate credentials. It is the established browser-based federation standard for external access, avoiding separate accounts for each partner.
- ✗
LDAP
Why it's wrong here
LDAP is a directory access protocol, not a federation protocol; it cannot broker cross-domain trust or issue assertions, so partners' corporate credentials would not authenticate. It is tempting because LDAP is genuinely used to query user directories within a single organisation, which is the wrong scenario here.
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.