hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Refer to the exhibit
Exhibit
<samlp:Response>
<saml:Assertion>
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">user@example.com</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"/>
</saml:Subject>
<saml:Conditions NotBefore="2024-06-21T00:00:00Z" NotOnOrAfter="2024-06-21T01:00:00Z"/>
<saml:AttributeStatement>
<saml:Attribute Name="role">
<saml:AttributeValue>admin</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>
</samlp:Response>Refer to the exhibit. A SAML response is received by the service provider. Which security issue is present?
⚠ Common exam trap
It's easy for candidates to assume the 'bearer' subject confirmation method is the security flaw, but the real issue is the absence of a digital signature on the assertion, which is a distinct and critical integrity control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The assertion is not signed
The SAML response shown in the exhibit lacks a digital signature on the assertion itself. Without the assertion being signed, a man-in-the-middle attacker could modify the assertion content (e.g., change the user identifier or attributes) after the response leaves the identity provider but before it reaches the service provider. SAML Core specification (OASIS SAML 2.0) requires that either the entire response or the individual assertion be signed to ensure integrity and non-repudiation; here, neither is signed, making the assertion vulnerable to tampering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The NameID format is incorrect
Why it's wrong here
The NameID element in a SAML response specifies the subject of the assertion, identifying the user. While various formats exist, including transient, persistent, and unspecified, the `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` format is a perfectly valid and commonly used identifier type. This format explicitly indicates that the NameID value should be interpreted as an email address, which is a standard and acceptable way to identify a user within a SAML assertion according to SAML specifications. Therefore, stating that this format is incorrect is inaccurate.
- ✓
The assertion is not signed
Why this is correct
A critical security requirement for SAML assertions is that they must be digitally signed by the Identity Provider (IdP). The absence of a digital signature on the assertion itself renders the entire SAML response vulnerable to tampering and repudiation. Without this cryptographic integrity check, a malicious actor could intercept the assertion, alter its contents—such as the user's identity or attributes—and then forward it to the Service Provider (SP) without detection. This fundamental flaw undermines the trust relationship between the IdP and SP, making the assertion unreliable and potentially dangerous.
- ✗
The validity window is too short
Why it's wrong here
The validity window, typically defined by `NotBefore` and `NotOnOrAfter` attributes, specifies the period during which a SAML assertion is considered valid. A one-hour validity window is not only acceptable but often considered good security practice, as it balances usability with security. Shorter validity periods reduce the window of opportunity for replay attacks, where an intercepted assertion could be reused by an unauthorized party. While extremely short windows might cause usability issues, a one-hour window strikes a reasonable balance between security and practicality, ensuring the assertion is fresh without being overly restrictive.
- ✗
The subject confirmation method is insecure
Why it's wrong here
The `Bearer` subject confirmation method, while seemingly simple, is a standard and acceptable mechanism within SAML 2.0. It implies that any party in possession of the assertion is considered to be the legitimate subject. Its security relies heavily on the secure transmission of the assertion, typically over TLS/SSL, and crucially, on the assertion being digitally signed by the Identity Provider. When these underlying security measures are in place, `Bearer` is not inherently insecure; rather, its security posture is derived from the integrity and confidentiality protections applied to the assertion itself during transit.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.