A security assertion may contain ________.

• A. Authenticity information
• B. attributes, such as spending limits for purchasers
• C. Both A and B
• D. Neither A nor B

Answer: (C)

Security assertions are signed statements issued by a trusted authority about a user, used to convey who the user is and what they’re allowed to do. They can include authentication information—that is, proof that the user has been verified (such as how and when they logged in)—and they can include attributes—data about the user or their entitlements, like a spending limit for purchasers. The assertion is digitally signed, providing authenticity information that others can verify. In many standards, an assertion may contain both types of information, along with other decision data. So, it’s correct to say a security assertion may contain authenticity information as well as attributes.