hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A multinational corporation deploys a single…
A multinational corporation deploys a single sign-on (SSO) solution using SAML 2.0 across all subsidiaries. Recently, users in one subsidiary report being unable to access an internal application. The identity provider (IdP) logs show successful authentication, but the service provider (SP) logs indicate assertion validation failures. Which of the following is the MOST likely cause?
⚠ Common exam trap
Watch out — candidates often confuse assertion validation failures (which involve timestamps, signatures, or conditions) with authentication failures (which involve credentials or IdP reachability), leading them to incorrectly select options like IdP unreachability or certificate expiration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The system clocks on the IdP and SP are significantly out of sync
SAML 2.0 relies on timestamps (NotBefore and NotOnOrAfter) within the assertion for validity. If the system clocks on the identity provider (IdP) and service provider (SP) are significantly out of sync, the SP will reject the assertion as expired or not yet valid, even though the IdP logs show successful authentication. This is the most common cause of assertion validation failures in cross-domain SSO deployments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The system clocks on the IdP and SP are significantly out of sync
Why this is correct
SAML assertions include `NotBefore` and `NotOnOrAfter` conditions, specifying the validity period. If the IdP and SP clocks are significantly out of sync, the SP might receive an assertion that, according to its own clock, is either not yet valid or already expired. This clock skew leads to a validation failure, often manifesting as a `InvalidTime` error, preventing successful authentication.
- ✗
The SP is configured to require a specific SAML attribute not present in the assertion
Why it's wrong here
If the Service Provider (SP) is configured to require a specific SAML attribute (e.g., a user role or group membership) for authorization, and that attribute is missing from the received assertion, the user's authentication would succeed, but access to the requested resource would be denied. This is an authorization failure, occurring after the SAML assertion itself has been successfully validated and the user's identity confirmed, not an assertion validation failure.
- ✗
The IdP server for the subsidiary is temporarily unreachable
Why it's wrong here
If the Identity Provider (IdP) server for the subsidiary is temporarily unreachable, the initial authentication request from the user's browser would fail to connect or receive a response from the IdP. This prevents the generation and issuance of any SAML assertion. The user would encounter a network error or timeout before any assertion could be sent to the Service Provider (SP), meaning the issue occurs prior to assertion validation at the SP.
- ✗
The SAML certificate used by the SP has expired
Why it's wrong here
An expired SAML certificate used by the Service Provider (SP) for signing requests or decrypting assertions would cause a cryptographic validation failure for *all* incoming SAML messages or outgoing requests. This is a global configuration issue affecting every user attempting to access the SP, regardless of their subsidiary. The problem would not be isolated to a single subsidiary but would manifest as a widespread SSO outage for that particular SP.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.