ISC2 Certified Cloud Security Professional (CCSP) Practice Question

In SAML 2.0 an assertion can contain several statement types. The AttributeStatement holds one or more Attribute elements that convey security-relevant data such as group membership, roles or entitlements. A cloud service provider reads these attributes and maps them to its own access-control constructs (for example, IaaS roles or network segment permissions). An AuthnStatement merely proves that authentication occurred, SubjectConfirmation carries information on how the subject was confirmed, and the Conditions element defines temporal or audience restrictions; none of these deliver the detailed authorization attributes required for least-privilege role mapping.