問題文
Two companies are about to connect their systems for single sign-on. The architect must explain how trust between the two systems is established before any user logs in. Which explanation is correct?
選択肢
- Trust is established at the first login attempt, when the service provider downloads whatever certificate the incoming message carries and stores it for later use.
- Trust comes from both systems using the same protocol version, and once both sides run that release of the standard every message between them counts as genuine, so the only setup step is agreeing on a version number.
- The two systems exchange the private keys that they use for signing, so that either side can reproduce the other side's signature and confirm that the message it received could only have been produced by a party holding that same key material.
- Each side registers the other's unique identifier and the public certificate that matches the signing key, so a signed message can later be verified as genuine.