Courseiva
← CISA
Full test
hardMultiple ChoiceObjective-mapped

CISA Practice Question: Refer to the exhibit

Exhibit

SAML 2.0 Response excerpt:
<saml:Assertion>
  <saml:Subject>
    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">user@example.com</saml:NameID>
  </saml:Subject>
  <saml:Conditions NotBefore="2024-01-01T00:00:00Z" NotOnOrAfter="2024-01-01T00:00:30Z" />
  <saml:AuthnStatement>
    <saml:AuthnContext>
      <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
    </saml:AuthnContext>
  </saml:AuthnStatement>
</saml:Assertion>

Refer to the exhibit. During a penetration test, a security analyst captures this SAML response. Which of the following security weaknesses is most evident?

⚠ Common exam trap

The trap here is that candidates focus on the authentication context or session duration as potential weaknesses, but the most evident vulnerability is the complete lack of assertion encryption, which is a direct violation of SAML security best practices and a common finding in penetration tests.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The assertion is not encrypted

The SAML response shows the assertion is sent in plaintext (no xenc:EncryptedData element), meaning the authentication assertion is not encrypted. This allows an attacker who intercepts the SAML response to extract the assertion and reuse it in a replay or impersonation attack, violating the confidentiality requirement for sensitive authentication tokens.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The name identifier format is inappropriate

    Why it's wrong here

    Email format is commonly used and appropriate.

  • ✗

    The session is too short

    Why it's wrong here

    A 30-second validity window is short but not a security weakness; it actually reduces window for replay attacks.

  • ✓

    The assertion is not encrypted

    Why this is correct

    Correct. The assertion is in plaintext, which could allow an attacker to read or modify the SAML response if not protected by TLS.

  • ✗

    The authentication context is weak

    Why it's wrong here

    PasswordProtectedTransport is an acceptable authentication context class.

About these practice questions

This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.