Study. uk . com
  1. Home
  2. All questions
  3. Question 50

CISSP study material · question 50 of 500

A SaaS provider follows the SP 800-63C-4 back-channel presentation model between its identity provider and several relying parties. To cut load, its gateway caches each assertion reference and lets any registered relying party redeem it for up to an hour. Which change aligns the design with that model?

  1. Let a single authenticating relying party redeem the reference once, inside a validity window under five minutes
  2. Keep the shared cache but sign every reference and shorten its validity window to five minutes
  3. Let any relying party redeem the reference once, over a mutually authenticated TLS channel to the gateway
  4. Pass the signed assertion through the browser instead, so no reference needs caching or redemption
Show the answer

Answer: A. Let a single authenticating relying party redeem the reference once, inside a validity window under five minutes

An assertion reference is redeemed once, by one relying party that authenticates to the identity provider, inside a short window; a shared cache and hour-long validity invite replay.

Source: NIST SP 800-63C Rev. 4 (NIST) — SP 800-63C-4 > Back-Channel Presentation

Challenge yourself on this topic → Study as cards