Which protocol does Cisco Duo use to transport authentication assertions for single sign-on?

SAML is designed to exchange authentication and authorization assertions between an identity provider and a service provider, so B is correct. In a Duo SSO flow, the protected application redirects the user to Duo, Duo performs primary authentication and policy or multifactor checks, and the resulting SAML assertion communicates the authenticated identity back to the application. Cisco Duo’s Single Sign-On documentation identifies Duo SSO as a cloud-hosted SAML 2.0 identity provider and explains that SAML delegates application authentication to an identity provider. SCEP enrolls devices for certificates, SCP securely copies files over SSH, and EAP provides an authentication framework commonly used for network access such as 802.1X. Those protocols do not transport browser-based SSO assertions between Duo and a SAML service provider.

================