Match each authentication protocol or method to its characteristic.
Drag a concept onto its matching description — or click a concept then click the description.
Uses tickets and symmetric key cryptography
XML-based federated identity protocol
Authorization framework for delegated access
AAA protocol for network access
Directory access protocol for authentication
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Kerberos: Uses tickets and symmetric key cryptography.
Correct matches: Kerberos uses tickets and symmetric keys for authentication; SAML uses XML assertions for single sign-on; OAuth provides delegated authorization via tokens. Common confusions include mixing cryptographic methods and confusing authorization with authentication.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Kerberos: Uses tickets and symmetric key cryptography.
Why this is correct
Kerberos relies on a trusted third party (KDC) to issue tickets, and uses symmetric keys for secure communication.
SAML: Uses XML-based assertions for single sign-on.
Why this is correct
SAML is an XML-based framework that allows identity providers to pass authorization credentials to service providers.
OAuth: Provides delegated authorization via tokens.
Why this is correct
OAuth is an authorization framework that enables third-party apps to obtain limited access to user resources without exposing credentials.
Kerberos: Uses certificates and asymmetric keys.
Why it's wrong here
This describes public key infrastructure (PKI) or protocols like TLS, not Kerberos. Kerberos primarily uses symmetric keys.
SAML: Used for OAuth 2.0 token exchange.
Why it's wrong here
SAML is not used for OAuth token exchange; OAuth has its own token formats (e.g., JWT) and uses endpoints like /token.
OAuth: Authenticates users with passwords.
Why it's wrong here
OAuth is for authorization, not authentication. Password-based authentication is handled by protocols like LDAP or direct credential verification.
Quick reference
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.