easyMultiple ChoiceObjective-mapped
CISSP Practice Question: Wants to implement single sign-on (SSO) for…
An organization wants to implement single sign-on (SSO) for multiple cloud applications. Which of the following is the most secure and scalable approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement SAML-based federation
SAML-based federation (Option A) is the most secure and scalable approach for SSO across multiple cloud applications because it is specifically designed for identity federation and cross-domain authentication. It allows organizations to centralize authentication and enforce policies without sharing passwords. Option B (OAuth) is an authorization framework, not an authentication protocol, and is less secure for SSO when used alone. Option C (same password) is insecure and not scalable. Option D (LDAP) is a directory service protocol that lacks native support for web SSO and does not scale well across cloud applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement SAML-based federation
Why this is correct
SAML (Security Assertion Markup Language) is an XML-based open standard specifically designed for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables Single Sign-On (SSO) by allowing a user to authenticate once with an IdP and then access multiple SPs without re-authenticating, using cryptographically signed assertions. This federation model ensures secure, scalable, and interoperable identity management across disparate systems, making it the industry standard for enterprise SSO.
- ✗
Use OAuth for authentication
Why it's wrong here
OAuth (Open Authorization) is an authorization framework that allows a third-party application to obtain limited access to a user's resources on an HTTP service, without exposing the user's credentials. While often used in conjunction with OpenID Connect (OIDC) for authentication, OAuth itself is not designed for user authentication or establishing a user's identity across multiple services for SSO. Relying solely on OAuth for SSO would be a misuse of the protocol and would not provide the necessary identity assertions or session management.
- ✗
Use the same password for all applications
Why it's wrong here
Using the same password for all applications, while seemingly simplifying user experience, creates an extreme security vulnerability by establishing a single point of failure. If one application's database is compromised or a credential is leaked, all other accounts using that identical credential become immediately vulnerable, leading to widespread account takeover. This practice fundamentally violates the principle of least privilege and robust password hygiene, making it an unacceptable and insecure solution for identity management.
- ✗
Implement LDAP directory
Why it's wrong here
LDAP (Lightweight Directory Access Protocol) is a protocol for accessing and maintaining distributed directory information services, primarily used for storing user accounts, groups, and other network resources. While an LDAP directory can serve as a backend user store for an SSO solution, LDAP itself does not provide the mechanisms for authentication token exchange, session management, or federated identity across different security domains. Implementing LDAP alone would only provide a centralized user repository, not the necessary SSO functionality.
Go deeper
Related to this question
Learn chapter
Cryptography and Its Applications
Key term
LDAP
LDAP is a protocol used to access and manage directory information over a network, such as user accounts and permissions.
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.