I thought it starts with B, since the user is usually sent to the IdP to authenticate before anything happens. But actually now that I think about it, if the initial step is always user action, then redirect (B) only happens after they try to access something. Really depends on whether you count hitting the protected site as part of the flow. So I went with B here-someone correct me if I’m missing something?

I get why some are saying B, since the SSO protocol technically starts at the redirect to the IdP. But I think D is still right here, since web-based SSO always begins with the user requesting access to the protected service-the app/resource has to trigger the whole flow first. Cisco wording can be vague sometimes though. Anyone else see practice questions ask it this way?

D is right, but does the question assume the user starts on the protected app or are they already at the IdP? If they begin at IdP, B might make sense, but usually it kicks off when accessing the service first.