Which of the following interactions does not occur as part of a web-based single sign-on scenario?

A.
A gateway, deployed In the Web Server, intercepts requests destined for protected resource

B.
The user is prompted for login credentials when a protected resource is accessed and the user
has not (recently) logged In.

C.
Credentials are passed to the application for validation.

D.
Authorization checks are optionally performed before the user is permitted access to the
application.

E.
A cookie is returned, which is used to permit access to other protected resources in that domain

Explanation:
The application does not handle the validation.