hardMultiple ChoiceObjective-mapped
200-901 Practice Question: An application uses OAuth 2.0 for authorization
An application uses OAuth 2.0 for authorization. The developer receives an access token but needs to know the user's identity. Which OAuth flow should be used to also obtain an ID token that contains user claims?
⚠ Common exam trap
Cisco often tests the misconception that any OAuth 2.0 flow can provide user identity, but only OpenID Connect (specifically the Authorization Code Grant with OIDC) adds the ID token for authentication; candidates may incorrectly choose the Client Credentials Grant, which is purely for machine-to-machine authorization and never includes user claims.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization Code Grant with OpenID Connect
OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds an ID token (a JWT) containing user claims such as name, email, and sub. The Authorization Code Grant with OIDC is the correct flow because it allows the client to request both an access token and an ID token, enabling the application to verify the user's identity while obtaining authorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authorization Code Grant without PKCE
Why it's wrong here
Without OpenID Connect, it returns only access token.
- ✓
Authorization Code Grant with OpenID Connect
Why this is correct
OpenID Connect adds ID token with user claims.
- ✗
Resource Owner Password Grant
Why it's wrong here
This is less secure and typically does not return ID tokens.
- ✗
Client Credentials Grant
Why it's wrong here
This grant is for server-to-server, no user identity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.