CompTIA CASP+ Practice Test

When authenticating over HTTP using SAML, what is issued to the authenticating user?

1. An assertion ticket

2. A security token

3. A user credential

4. A session ID

The correct answer is: An assertion ticket

When authenticating over HTTP using SAML (Security Assertion Markup Language), the process revolves around the exchange of assertions that contain statements about the user. The correct answer, an assertion ticket, is produced as part of this SAML authentication flow. SAML assertions are XML-based structures that a SAML authority (usually an Identity Provider) sends to the Service Provider (the application or service the user is trying to access). These assertions confirm the user's identity and can include various attributes about the user, such as roles and permissions or other relevant metadata. This verification mechanism allows the system to trust that the identity provided by the user has been validated by the identity provider. The assertion ticket acts as proof of this authentication and can be used by the service provider to grant or deny access based on the contents of the assertion. While other choices represent elements involved in different authentication mechanisms—security tokens are generally used in various contexts to carry authentication data; user credentials refer to specifics like passwords or usernames; and session IDs manage state for user sessions—none of these specifically denote the SAML assertion in this context. Thus, the assertion ticket is the key element that is issued to the user during the SAML authentication process, making it the correct choice.