SSCP Access Controls Practice Question
In a federated identity scenario, a user authenticates to their home domain and accesses a resource in a partner domain. The partner domain trusts the authentication performed by the home domain. What is the home domain's role in this trust relationship?
⚠ Common exam trap
The trap is the interchangeable-sounding terms Relying Party, Service Provider, and IdP — candidates must remember that the authenticating home domain is always the IdP, while the resource-owning partner domain is the RP/SP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Provider (IdP)
In a federated identity trust, the home domain that authenticates the user and issues the security token is the Identity Provider (IdP). The partner domain that consumes that assertion and grants access is the Relying Party (or Service Provider). The IdP is trusted because it vouches for the user's identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Relying Party
Why it's wrong here
The relying party is the partner domain that consumes and trusts the home domain's authentication assertion; the home domain acts as the identity provider. It is tempting because the partner trusts the assertion, and would be correct if the question asked about the partner domain's role.
- ✓
Identity Provider (IdP)
Why this is correct
The home domain authenticates the user and issues the assertions the partner domain consumes, so it acts as the Identity Provider (IdP). The partner domain is the relying party or service provider that trusts those assertions.
- ✗
Service Provider (SP)
Why it's wrong here
The service provider is the partner domain consuming assertions, not the home domain issuing them. Here the home domain authenticates the user and asserts identity, making it the identity provider. SP is tempting because it accurately describes the resource-holding party, but the stem asks about the authenticating domain's role.
- ✗
Kerberos Distribution Center (KDC)
Why it's wrong here
A KDC issues Kerberos tickets within a single realm; it does not assert identity across organisational boundaries. Federation requires the home domain to act as the identity provider, issuing signed assertions the partner consumes. KDC is tempting because it authenticates users centrally, but that is intra-domain SSO, not cross-domain trust.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.