In federated identity management, firms do not query one another's identity management databases.

• A. TRUE
• B. FALSE
• C. Sometimes
• D. Depends on federation

Answer: (A)

In federated identity management, authentication is handled by a trusted identity provider in the user’s home organization, and the service you’re trying to access relies on a signed token or assertion from that IdP. The service provider does not query the other organization’s user database for each login. Instead, the IdP proves who the user is and releases only the necessary attributes to the service, via the assertion. This creates a trust boundary where identity data stays with the IdP, and the relying party trusts the IdP’s authentication rather than querying another organization’s database directly. There can be attribute retrieval mechanisms, but they operate within the federation and still rely on the IdP to authorize what is shared. That’s why the statement is true.