CA Single Sign-On 12.x Proven Implementation Professional Exam (CAT-140) Study Guide Version 1.5

Transcription

1 Study Guide Version 1.5

2 PROPRIETARY AND CONFIDENTIAL INFORMATION 2018 CA. All rights reserved. CA onfidential & proprietary information. For CA, CA Partner and CA Customer use only. No unauthorized use, opying or distribution. All names of individuals or of ompanies referened herein are fititious names used for instrutional purposes only. Any similarity to any real persons or businesses is purely oinidental. All trademarks, trade names, servie marks and logos referened herein belong to their respetive ompanies. These Materials are for your informational purposes only, and do not form any type of warranty. The use of any software or produt referened in the Materials is governed by the end user s appliable liense agreement. CA is the manufaturer of these Materials. Provided with Restrited Rights.

3 The CA Tehnologies Certifiation Program is designed to measure your skills, knowledge, and expertise in managing, administering, installing, onfiguring and implementing selet CA Tehnologies produts for omplete and optimized IT solutions. With CA ertifiations, management teams will have peae of mind that knowledgeable professionals are handling their CA Tehnologies appliations. Protored by a third party vendor, KryterionOnline, CA Tehnologies ertifiations objetively validate the ompetenies of a projet team whether that team is your in-house staff, CA Tehnologies Professional Servies, or a CA Tehnologies partner. The aim of this doument is to help you prepare for the CA Single Sign-On 12.x Proven. Make sure that you familiarize yourself with the ontent areas tested. Your best path to suess is to attend the exam prep ourse(s). You may also find it helpful to review the produt doumentation at and to partiipate in CA Global User Community forums at The experiene gained from taking ourses and using the produt will help you: Gain a omprehensive understanding of the produt or solution Inrease the likelihood of passing the exam on your first attempt The Exam Experiene You an register to take an online protored exam from your home or offie using Kryterion s Online Protoring (OLP) Servies, or you an take an on-site protored exam at a Kryterion testing enter. If you hoose to take an online protored exam, you will need Internet aess, an external web amera, and a omputer that meets speifi hardware and software requirements. For answers to frequently asked questions about registering for exams, loations, on-site and virtual protoring, OLP equipment requirements, anellation and re-sheduling poliies and more, read our FAQs at n-faq.aspx. CA employees may also go here for more information: Professional Exam Details Produt release: Major release listed in the title; Inludes subsequent point releases Reertifiation: There is no annual requirement to reertify for the same release of a produt. For eah major produt release, an updated exam will be available for reertifiation. Number of items = 50 Item types = Multiple hoie, inluding multiple response questions Time to omplete test: 90 minutes Passing sore is 70% Attempts Permitted: You may register for your first retake immediately. For subsequent retakes you are required to wait at least thirty (30) alendar days from the date of your last attempt. Read the online FAQs for details.

4 Only qualified andidates who demonstrate ompeteny by suessfully passing the CA Tehnologies ertifiation exam will be awarded ertifiation redentials. Prospetive ertifiation andidates are enouraged to prepare for the exam using the Exam Study Guide and other materials available on the Certifiation from CA Tehnologies website. To safeguard the integrity of the ertifiation program, CA Tehnologies requires all andidates to behave in an ethial manner and to omply with the rules of the third-party test enter for on-site protoring and on-line protoring. The validity of the ertifiation program depends on the exam ontent remaining seure and undislosed to other potential ertifiation andidates. CA Tehnologies will not tolerate heating, fraud, or misondut, whih inludes but is not limited to the following: Obtaining, whether through purhase or otherwise aquiring, unauthorized exam preparation materials from any non-ca website Obtaining, whether through purhase or otherwise aquiring, unauthorized exam questions from any non-ca website, inluding brain dump websites Aquiring or attempting to aquire exam questions through online ommunities, hat rooms, sreen apture software, forums, and soial networking sites Aquiring or attempting to aquire exam ontent through CA Subjet Matter Experts, CA Support Staff, or CA Certified Professionals Using or attempting to use a proxy to sit for the exam in your plae Taking or attempting to take an exam for someone else Reeiving or giving assistane during an exam Sharing exam questions or answers with a potential ertifiation andidate Violating testing enter rules Falsifying a diploma or sore report Using a CA Tehnologies ertifiation logo or redential to whih you are not entitled CA Tehnologies reserves the right to take any ations it deems reasonably appropriate in the ase of suspeted misondut or violation of the terms of the Non-Dislosure Agreement, inluding, but not limited to, anelling an exam result, revoking exam or ertifiation status, terminating use of the Designation, requiring a andidate to retake an exam, banning a andidate from the ertifiation program, and reporting misondut to the andidate s employer. CA Tehnologies onsiders heating a serious offense that warrants disiplinary ation, up to and inluding termination of employment.

5 Areas of Study support.a.om Experiene Prior Knowledge Best Praties youtube.om/atehnologies developer.a.om doops.a.om ommunities.a.om wiki.a.om Use Cases & Senarios Pratial Appliation of Course Conepts For relevant ourseware, see the next page. Searh the CA Eduation Portal for latest ourses, as they may not have been available at the time of this doument posting: Partners & Customers look here: Employees look here: For doumentation, Communities, and more visit: Register for the exam here:

6 Areas of Study Note: Relevant ourseware is available in various formats. For more details, see the produt learning path. CA Single Sign-On 12.7.x: Foundations 200 (Dynami Lab) 04SSO2017S 9 hours OR CA Single Sign-On 12.7.x: Foundations 200 Instrutor-led Training / Virtual Learning (ILT/VL) 04SSO days OR Coming Soon: Subsription-based Individual Courses CA Single Sign-On 12.7.X: Use the CA Aess Gateway for Federated Soial Sign-On SSO20180 Web-Based Training (WBT) 30 minutes Advaned Topis CA Single Sign-On: Advaned Topis 300 Coming Soon OR CA Single Sign-On: Advaned Topis 300: Configure CA Diretory as a Session Store 04SSO3005S Dynami Lab 1.25 hours 04SSO30050 WBT 30 minutes CA Single Sign-On: Advaned Topis 300: Protet the Session and Constrain Hijaking 04SSO3006S Dynami Lab Coming Soon 04SSO30060 WBT 15 minutes Advaned Topis Continued CA Single Sign-On: Advaned Topis 300: Enable Enhaned Session Assurane with DevieDNA 04SSO3007S Dynami Lab 45 minutes 04SSO30070 WBT 15 minutes CA Single Sign-On: Advaned Topis 300: Configure the Authentiation and Authorization Web Servies 04SSO3012S Dynami Lab 1.25 hours 04SSO30120 WBT 30 minutes CA Single Sign-On: Advaned Topis 300: CA SSO OpenID Connet 04SSO3011S Dynami Labs 04SSO30110 WBT 30 minutes CA Single Sign-On: Advaned Topis 300: Implement Soial Sign-On with Partnership Federation 04SSO3009S Dynami Labs 04SSO30090 WBT 30 minutes CA Single Sign-On: Advaned Topis 300: Enhane Seurity with Session Linking 04SSO3015S Dynami Labs Coming Soon 04SSO30150 WBT Coming Soon CA Single Sign-On: Advaned Topis 300: Federate Mirosoft Offie SSO3016S Dynami Labs Coming Soon 04SSO30160 WBT Coming Soon CA Single Sign-On: Advaned Topis 300: Use the Poliy Objet REST APIs 04SSO3019S Dynami Labs Coming Soon 04SSO30190 WBT Coming Soon

7 Exam objetives as they map to related ourseware and the body of knowledge, inluding perentage of exam devoted to topis. Related Content Exam Fous Understanding CA SSO Understanding the CA SSO Arhiteture and Installation Configuring the Poliy Server with the Management Console Navigating the Admin UI to Administer Agents and Hosts Creating an Aess Poliy Using the CA Aess Gateway to Proxy Web Site Aess CA Single Sign-On 12.7.x: Foundations 200 (04SSO2017S or 04SSO20171) Introdution Prerequisite reap Definitions CA Single Sign-On 12.7.x: Foundations 200 (04SSO2017S or 04SSO20171) Arhiteture and Installation Overview Major Components Deployment Arhitetures Installation Overview CA Single Sign-On 12.7.x: Foundations 200 (04SSO2017S or 04SSO20171) Configure the Poliy Server with the Management Console Desribe the Management Console Start/Stop the Poliy Server Enable Poliy Server Profiling CA Single Sign-On 12.7.x: Foundations 200 (04SSO2017S or 04SSO20171) Navigate the Admin UI to Administer Agents and Hosts Create Agent Identities Create Agent Configuration Objets Create Host Configuration Objets Manage Cahe CA Single Sign-On 12.7.x: Foundations 200 (04SSO2017S or 04SSO20171) Create an Aess Poliy Poliy Considerations: Get Organized Connet to Ative Diretory and LDAP User Diretories Integrate a Web Site Using Responses Configure Full Logoff CA Single Sign-On 12.7.x: Foundations 200 (04SSO2017S or 04SSO20171) Use the CA Aess Gateway to Proxy Web Site Aess Meet the CA Aess Gateway Admin UI Enable Logon to the CA Aess Gateway Admin UI Configure Virtual Hosts on the CA Aess Gateway Configure Proxy Rules to Bak-end Servers Create an Aess Poliy using the CA Aess Gateway 8% 8% 6% 8% 14% 10%

8 Getting Help Related Content Exam Fous Understanding Federated Soial Sign-On Configuring CA Diretory as a Session Store Proteting the Session and Constraining Hijaking Enabling Enhaned Session Assurane with DevieDNA Configuring the Authentiation and Authorization of Web Servies Understanding CA SSO Open ID Connet Federating Mirosoft Offie 365 CA Single Sign-On 12.7.x: Foundations 200 (04SSO2017S or 04SSO20171) Getting Help One View Monitor Remote Engineer CA Single Sign-On 12.7.X: Use the CA Aess Gateway for Federated Soial Sign-On 200 (04SSO20180) Use the CA Aess Gateway for Federated Soial Sign-on CA Single Sign-On: Advaned Topis 300: Implement Soial Sign-On with Partnership Federation (04SSO3009S or 04SSO30090) Implement Soial Sign-On with Partnership Federation Federation Defined Support for Soial Sign on Overview CA SSO Entities CA SSO Partnerships CA Single Sign-On: Advaned Topis 300: Configure CA Diretory as a Session Store (04SSO3005S or 04SSO30050 ) Configure CA Diretory as a Session Store CA Single Sign-On: Advaned Topis 300: Protet the Session and Constrain Hijaking (04SSO3006S or 04SSO30060) Protet the Session and Constrain Hijaking Invalidated Redirets Cross-site Sripting Constrain Hijaking Session Management DNS Denial of Servie CA Single Sign-On: Advaned Topis 300: Enable Enhaned Session Assurane with DevieDNA (04SSO3007S or 04SSO30070) Enable Enhaned Session Assurane with DevieDNA CA Single Sign-On: Advaned Topis 300: Configure the Authentiation and Authorization of Web Servies (04SSO3012S or 04SSO30120) Configure the Authentiation and Authorization of Web Servies CA Single Sign-On: Advaned Topis 300: CA SSO Open ID Connet (04SSO3011S or 04SSO30110) CA SSO Open ID Connet CA Single Sign-On: Advaned Topis 300: Federate Mirosoft Offie 365 (04SSO3016S or 04SSO30160) Federate Mirosoft Offie 365 6% 10% 4% 10% 2% 4% 2% 2%

9 Related Content Exam Fous Understanding the Poliy Objet REST APIs Using the Web Agent in Dynamially Saled Environments Understanding Kerberos Constrained Delegation CA Single Sign-On: Advaned Topis 300: Use the Poliy Objet REST APIs (04SSO3019S or 04SSO30190) Use the Poliy Objet REST APIs Doumentation and Field Experiene Using the Web Agent in Dynamially Saled Environments Doumentation and Field Experiene Using Kerberos Constrained Delegation 2% 2% 2%

10 Sample Certifiation These sample questions are very similar to the questions in the atual exam. Some questions may inlude several orret options. Questions Options Question 1 In CA SSO, whih data stores are required? (Choose three) A. Key store B. User store C. Audit store D. Poliy store E. Session store Question 2 Whih statement about CA SSO rules is TRUE? Question 3 Whih features haraterize the CA SSO Appliation Server Agent (ASA)? (Choose two) A. Group resoures with a ommon seurity requirement B. Are triggered on speifi authentiation or authorization events C. Are used to assign an authentiation sheme to proteted resoures D. Identify speifi resoures and allow or deny aess based on speifi HTTP operations performed on those resoures A. Supports IBM WebSphere and Orale WebLogi B. Moves the point of trust from the web server to the ERP/CRM server C. Makes alls to the Event Manager when authentiation redentials are provided D. Protets appliations in Java 2 Platform Enterprise Edition (J2EE)-based appliation servers Question 4 You an optionally inlude CA Aess Gateway in your deployment arhiteture. Whih statement about CA Aess Gateway is TRUE? A. It an be onfigured as a web server plug-in or to work with a web server on the same system. B. It has built-in high availability, whih is onfigurable within its parameters aross multiple instanes. C. It is a reverse proxy server that ahes many resoures from the destination servers to provide ready aess for users. D. It is a stand-alone server that provides a proxy-based solution for aess ontrol and supports multiple session shemes that do not rely on traditional ookie-based tehnology. Question 5 Whih tool an be used to establish a trust relationship between the CA SSO UI and the Poliy Server? A. smreg B. smobjimport C. smobjexport D. XPSRegClient

11 Questions Question 6 CA SSO administrator Sue Anderson sets the value of Maximum Timeout to two hours for a onfigured realm. As a result, the user session: Question 7 In Federal Information Proessing Standards (FIPS)-only mode, whih algorithm does CA SSO use? Question 8 In relation to agents, what does entral onfiguration indiate? Question 9 CA SSO features poliy domain-based and appliation-based poliy management. The appliation-based model is also known as the Enterprise Poliy Management (EPM) model. Whih feature haraterizes the appliationbased model? Question 10 You want to enable a CA SSO Forms Credential Colletor (FCC) to serve up forms for resoures proteted by 4.x Web Agents or third-party appliations. To aomplish this, in the Agent Configuration Objet (ACO), you need to set: Question 11 In CA Aess Gateway, proxy rules define how the requests are forwarded or redireted to resoures loated on destination servers. After you hange a proxy server rule, what do you need to do? Options A. will time out after two hours only if it is idle for two hours. B. will time out after two hours, even if the user is atively aessing an appliation proteted by the realm. C. will not time out irrespetive of the setting, if the user is atively aessing an appliation proteted by the realm. D. will time out after two hours irrespetive of any ativity but only if Sue also sets the Idle Timeout to at least two hours. A. Advaned Enryption Standard (AES) Seure Hash Algorithm 2 (SHA-2) 256-bit B. Message-Digest 5 (MD5) C. AES SHA bit D. RC4 A. The Web Agent holds the initialization parameters for trusted hosts. B. The Web Agent overrides the onfiguration parameters of trusted hosts. C. The Web Agent is onfigured from a loal onfiguration file on the web server. D. The Web Agent is onfigured from the Agent Configuration Objet (ACO) on the Poliy Server administrative UI. A. It makes identity mapping easier. B. It uses an appliation-entri approah. C. Its three ore omponents are domains, realms, and agents. D. It uses a different seurity enforement model than that built around CA SSO. A. LegayEnoding to Yes. B. AeptTPCookie to Yes. C. FCCCompatmode to NO. D. FCCCompatmode to YES. A. Restart the Poliy Server. B. Restart CA Aess Gateway. C. Restart the Apahe omponent of CA Aess Gateway only. D. Only save your settings beause your hanges take effet shortly after this without the need for a restart.

12 Questions Question 12 When you onfigure federation, you an speify Seurity Assertion Markup Language (SAML) or Web Servies Federation Language (WS- Federation) asserting parties and relying parties. Asserting parties an inlude: (Choose three) Question 13 In your CA SSO environment, adding CA SSO Federation enables you to: Question 14 To store session IDs in an Open Database Connetivity (ODBC) database, whih steps must you perform? (Choose three) Question 15 In a multiple-ookie domain environment, whih statement about ookie provision in a CA SSO enterprise is TRUE? Question 16 Whih feature haraterizes the SSOTrustedZone parameter? Question 17 How do you an reate a new Session Assurane end point? Options A. SAML 1.x produers. B. SAML 2.0 Servie Providers. C. SAML 2.0 Identity Providers. D. WS-Federation Aount Partners (WSFED Identity Providers). E. WS-Federation Resoure Partners (WSFED Resoure Partners). A. define firewall poliies. B. manage omponent liensing agreements. C. implement single sign-on (SSO) aross different seurity domains. D. bind the CA SSO and Java 2 Platform Enterprise Edition (J2EE) sessions together. A. Disable Idle Timeout. B. Connet the Audit Store to the ODBC database. C. Connet the ODBC database to the Poliy Server. D. Enable Persistent Session for the required poliy realm. E. Set the session validation period to be less than the Idle Timeout value. A. Eah Web Agent ats as a ookie provider. B. Only one key store ats as a ookie provider. C. Only one Web Agent ats as a ookie provider. D. Eah Poliy Server instane ats as a ookie provider. A. It is a single-value parameter. B. It is always populated with the SM zone by default. C. Its value is prepended to the name of a ookie that the Web Agent reates. D. It defines an ordered list of trusted SSOZoneNames for a single sign-on (SSO) seurity zone. A. Use the CA SSO Admin UI. B. Add a virtual host to CA Aess Gateway. C. Modify the server.onf file for CA Aess Gateway. D. Install a Web Agent on the web server that hosts the appliation you are proteting.

13 Questions Question 18 You are onfiguring load balaning for several Lightweight Diretory Aess Protool (LDAP) user diretories. You want to fore a speifi diretory server to servie more requests. How an you aomplish this? Question 19 As part of an ongoing effort to improve performane and high availability, Administrator Brue Adams has reated a Host Configuration Objet (HCO) for a luster. The luster onsists of four Poliy Servers, eah in a different data enter. All Poliy Servers point to an existing poliy store. Brue wants to maximize fault tolerane for Web Agents to avoid problems if the Poliy Server in any data enter beomes unavailable. What must Brue do? Question 20 You are planning a CA SSO-based single sign-on (SSO) infrastruture. Whih apaity onsideration is the MOST signifiant? Options A. Use server aliases. B. Assign a higher priority number. C. Plae the server higher in the list. D. Add the speifi diretory server multiple times in the diretory onfiguration of the load balaned setup. A. Point the webagent.onf file to the new HCO name and restart the web server instane. B. Perform a omplete reonfiguration of the Web Agent, whih is needed to use the new HCO. C. Add the new luster HCO in the smhost.onf file and add all four Poliy Servers is the list of boot strap Poliy Servers. D. Register a new trusted host going against the Poliy Servers to reate a new smhost.onf file. Referene the new smhost.onf file in webagent.onf and add the new luster HCO name in webagent.onf. A. Type of operating system B. Total number of users in the user diretory C. Total number of poliy objets in the poliy store D. The number of onurrent users that will aess the system

14 Answers Question 1 = A, B, and D Question 2 = D Question 3 = A and D Question 4 = D Question 5 = D Question 6 = B Question 7 = A Question 8 = D Question 9 = B Question 10 = D Question 11 = D Question 12 = A, C, and D Question 13 = C Question 14 = C, D, and E Question 15 = C Question 16 = D Question 17 = A Question 18 = D Question 19 = C Question 20 = D

15 Register for the Exams To register and pay for any of the Proven Implementation Professional ertifiation exams, visit our third party testing partner, Kryterion Online. Eah exam attempt osts $150. Payment and vouhers are only aepted during registration and sheduling on the third party website. We are not able to proess payment for Proven Implementation Professional exams on the LMS Training Portal.