SSCP Access Controls Practice Question
A small business wants to implement single sign-on so employees can authenticate once and reach several internal web applications without re-entering credentials. The applications support SAML 2.0. Which component issues the signed assertion that the applications consume to establish the user's identity?
⚠ Common exam trap
The trap here is assuming the application or browser issues the identity assertion, when SAML places assertion issuance with the identity provider and consumption with the service provider.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The identity provider
SAML 2.0 separates the identity provider, which authenticates users and issues signed assertions, from the service provider, which consumes and trusts them. The business needs one authentication event to reach multiple applications, so the identity provider is the issuing component. Certificate authorities and browsers support the exchange but do not create assertions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user agent (browser)
Why it's wrong here
The browser acts as the user agent that carries SAML messages between the identity provider and the service provider, but it does not issue assertions. It relays the signed response after the identity provider generates it. Because the browser is untrusted from a protocol standpoint, it cannot be the source of identity assertions. This option confuses message transport with assertion issuance.
- ✗
The service provider
Why it's wrong here
The service provider is the application that consumes the assertion and grants access based on it. It does not issue the assertion; it trusts an identity provider to do so. Confusing the two roles is common because both participate in the exchange, but in SAML the service provider is the relying party, not the issuer. It validates the signature and extracts attributes rather than creating them.
- ✗
The certificate authority
Why it's wrong here
A certificate authority issues digital certificates that can be used to sign or encrypt SAML assertions, but it does not create the assertions themselves. It provides the trust anchor that lets the service provider verify the identity provider's signature. The business needs a component that authenticates users and emits assertions, which is a different role than issuing certificates, so this option misidentifies the function.
- ✓
The identity provider
Why this is correct
In SAML 2.0, the identity provider authenticates the user and issues a signed assertion containing authentication and attribute statements. The service provider trusts that signature and uses the assertion to establish a session. Since the business wants one authentication event to serve multiple applications, the identity provider is the component that generates the assertion the applications consume.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.