ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Active Directory Federation Services (ADFS) can act as an on-premises Security Token Service, issuing SAML 2.0 claims after authenticating users directly against the domain controllers. Publishing ADFS through a Web Application Proxy exposes the federation endpoints securely to the Internet, allowing external SaaS providers (relying parties) to trust the tokens without requiring user passwords to be copied or synchronized outside the organization. Azure AD Connect with password-hash sync violates the policy because hashes are uploaded to Azure AD. Direct LDAP binds from SaaS vendors would require exposing domain controllers and does not deliver standards-based SSO. A RADIUS solution could add strong authentication but does not provide SAML assertions required by the SaaS applications and still would not satisfy true federation. Therefore, deploying ADFS with a Web Application Proxy best satisfies both SSO and on-premises authentication requirements.