CISSP Identity and Access Management Practice Question
In SAML 2.0, which component is responsible for authenticating the user and generating an assertion?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Provider (IdP)
The Identity Provider (IdP) authenticates users and creates assertions containing authentication/attribute/authorization data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identity Provider (IdP)
Why this is correct
The Identity Provider (IdP) is the authoritative entity responsible for authenticating the user's identity within a SAML 2.0 federation. It verifies user credentials against its own identity store (e.g., an LDAP directory or database) and, upon successful authentication, generates a digitally signed SAML assertion containing the user's authentication status and relevant attributes. This assertion is then securely transmitted to the Service Provider, confirming the user's identity without sharing their actual credentials.
- ✗
Service Provider (SP)
Why it's wrong here
The Service Provider (SP) is the application or service that a user wishes to access, relying on the IdP for authentication decisions. In the SAML 2.0 flow, the SP receives and validates the SAML assertion issued by the IdP, consuming the authentication and attribute statements within it. While the SP grants access based on the assertion, it does not perform the initial user authentication itself; its role is to trust and act upon the IdP's verification.
- ✗
Certificate Authority (CA)
Why it's wrong here
A Certificate Authority (CA) is a trusted third party in a Public Key Infrastructure (PKI) that issues and manages digital certificates, which bind public keys to identities. While CAs are vital for establishing cryptographic trust, such as signing SAML assertions to ensure their integrity and authenticity, or securing the communication channels between IdP and SP, they are not directly involved in the user authentication process or the generation of the SAML authentication assertion itself. Their function is to provide verifiable trust for cryptographic operations.
- ✗
Relying Party (RP)
Why it's wrong here
A Relying Party (RP) is a general term in federated identity management for any entity that trusts and acts upon assertions or claims made by another party, typically an Identity Provider. In the context of SAML 2.0, the Service Provider (SP) functions as the Relying Party because it relies on the authentication assertions provided by the IdP to grant user access. However, the term 'Relying Party' describes the SP's trust relationship, not its specific role in performing user authentication.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.