CCSP Cloud Application Security Practice Question
A company uses a cloud-based identity provider for single sign-on. An application needs to verify the user's identity without storing credentials. Which token type should the application validate?
⚠ Common exam trap
ISC2 often tests the distinction between authentication tokens (SAML) and authorization tokens (OAuth access tokens), leading candidates to pick OAuth access token because they confuse it with OpenID Connect ID tokens, which are actually JWTs used for identity in modern SSO.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAML assertion
A SAML assertion is the correct choice because it is specifically designed for single sign-on (SSO) scenarios where an identity provider (IdP) authenticates a user and issues a signed XML token containing the user's identity and attributes. The application validates the assertion's signature and trust relationship with the IdP, verifying the user's identity without ever storing or handling credentials. This aligns with the cloud-based identity provider model described in the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SAML assertion
Why this is correct
SAML assertions are used in SSO to convey user identity and attributes.
- ✗
JWT
Why it's wrong here
JWT is typically used for API authorization, but for SSO, SAML is the standard.
- ✗
Kerberos ticket
Why it's wrong here
Kerberos is a network authentication protocol, less common in cloud SSO scenarios.
- ✗
OAuth access token
Why it's wrong here
OAuth access tokens are for granting access, not directly validating identity.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.