CISSP Study Plan – Day 33 of 55 | SAML (Security Assertion Markup Language)

“Rain or shine a CISSP will do what they have to do.” – Luke Ahmed

Today is Day 33 of Yihenew’s CISSP study plan, focusing on SAML — Security Assertion Markup Language, one of the most important identity federation standards every CISSP must understand.

SAML allows users to authenticate once and access multiple systems or services across domains — it’s the foundation of Single Sign-On (SSO) in enterprise environments. Knowing how and why SAML works connects directly to your CISSP understanding of trust, risk, and federated identity.

Key Areas Covered in the CISSP Study Plan

• Purpose of SAML — Enables identity federation between an Identity Provider (IdP) and a Service Provider (SP), reducing the need for multiple logins.

• How It Works — The IdP authenticates the user and sends a SAML assertion (XML-based message) to the SP, confirming the user’s identity.

• Core Components:

  • Assertions — Contain authentication, attribute, and authorization data

  • Bindings — Define how messages are transported (HTTP Redirect, POST, SOAP)

  • Profiles — Describe specific use cases, such as Web Browser SSO

• Common Risks:

  • XML Signature Wrapping attacks

  • Improperly validated assertions

  • Lack of encryption or signature verification

• Mitigation Measures:

  • Enforce strong XML signature validation

  • Use HTTPS/TLS for all SAML traffic

  • Limit token lifetimes and replay windows

• 
  

CISSP Exam Tie-In

Expect scenario questions about federated identity systems asking who authenticates and who authorizes.

• The IdP authenticates the user.

• The SP authorizes access based on the received SAML assertion.The CISSP exam often tests whether you understand this trust flow — not the technical configuration.

Quick CISSP Practice Question

In a federated identity system using SAML, which entity is responsible for authenticating the user?

A. The Service Provider (SP)

B. The Resource Owner

C. The Identity Provider (IdP)

D. The Relying Party

✅ Correct Answer: C. The Identity Provider (IdP)

Explanation:The Identity Provider validates user credentials and generates an authentication assertion, which is then consumed by the Service Provider to grant access. The SP relies on the IdP’s assurance rather than performing authentication itself.

Think Like a Manager:When designing or assessing federated identity, think in terms of trust delegation — who owns the authentication process, and who relies on that decision?

Check out Yani's TikTok or see Day 32 or Day 34.

👉 Can you take the Yani Challenge?

55 days of consistent CISSP prep, tackling one domain at a time, using only the resources below:

Course

Luke's CISSP Course (2 months access, $89.98)

One-to-one Zoom sessions with Luke Ahmed (2 weeks before exam)

Books, Notes, and Practice Questions

All-In-One Study Guide by Shon Harris (Around $45)

Sybex 10th Edition (Around $52.55)

Official CISSP Practice Tests, 4th Edition by Mike Chapple & David Seidl (Around $35)

How To Think Like A Manager for the CISSP Exam ($29.99)

Total Cost: approxiamately $250 depending on your geographic location. Yani is located in East Africa.

📚 Study Plan (55 Days of Dedication):

- Weekdays: 2–3 hours of focused study—late nights and early mornings (5 AM).

- Weekends: 5–6 hours of deep study sessions.

Pass CISSP in first attempt within 100 questions.

Yani's biggest expense was his time, committment, consistency, and dedication! It was worth it because he passed first attempt in 100 questions using the above resources only.

If Yihenew could do it, so can you.

All the best Future CISSP. You can feel free to contact me anytime as well.

Thank you.

Luke Ahmed