CISSP Identity and Access Management Practice Question
A developer is implementing OAuth 2.0 for a mobile app (public client) that needs to access a user's data from a third-party API. To mitigate the authorization code interception attack, which OAuth 2.0 extension should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PKCE
PKCE (Proof Key for Code Exchange) is designed for public clients to prevent interception of the authorization code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Device code grant
Why it's wrong here
The Device Code Grant is designed for input-constrained devices, such as smart TVs or IoT devices, where a user cannot easily type credentials. It requires the user to visit a separate browser on another device to authorize the request, which is an unnecessary and cumbersome step for a typical mobile application with full input capabilities. Therefore, it is not suitable for the user experience and security profile of a standard mobile app.
- ✗
Client credentials grant
Why it's wrong here
The Client Credentials Grant is intended for server-to-server communication where a confidential client (a server application) authenticates itself using a client ID and a client secret to access resources on its own behalf, not on behalf of an end-user. Mobile applications are considered public clients because they cannot securely store a client secret, making this grant type inappropriate as it would expose the secret to potential attackers. This grant type also lacks user context, which is typically required for mobile app interactions.
- ✗
Implicit grant
Why it's wrong here
The Implicit Grant is deprecated due to significant security vulnerabilities, particularly its direct return of the access token in the URL fragment. This method exposes the token to risks like interception via browser history, referrer headers, or malicious scripts (XSS attacks), as there is no proof of possession mechanism. Furthermore, it typically does not support refresh tokens, requiring re-authentication more frequently and making it less secure and less efficient for mobile applications.
- ✓
PKCE
Why this is correct
Proof Key for Code Exchange (PKCE) enhances the Authorization Code Grant flow, making it secure for public clients like mobile applications that cannot securely store a client secret. It mitigates the authorization code interception attack by requiring the client to generate a cryptographically random `code_verifier` and a `code_challenge` derived from it. The `code_challenge` is sent with the initial authorization request, and the `code_verifier` is later presented when exchanging the authorization code for an access token, proving the client's identity without a shared secret.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.