hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Is implementing federated identity to allow…
An organization is implementing federated identity to allow partners to access its web application. The solution must support single logout and attribute exchange. Which protocol is most appropriate?
⚠ Common exam trap
Many candidates confuse OAuth 2.0 with OpenID Connect or assume that OAuth 2.0 alone can handle authentication and logout, but OAuth 2.0 is strictly an authorization protocol and lacks the session management and attribute exchange features required for federated identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAML 2.0
SAML 2.0 is the most appropriate protocol because it natively supports both single logout (SLO) and attribute exchange as core features. It uses XML-based assertions to transfer identity and attribute data between an identity provider (IdP) and a service provider (SP), and its SLO mechanism ensures that when a user logs out from one application, all sessions across participating services are terminated simultaneously.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SAML 2.0
Why this is correct
SAML 2.0 is the industry standard for federated identity management, specifically designed for cross-domain single sign-on (SSO) and robust attribute exchange. Its XML-based assertions securely convey authentication and authorization information between an Identity Provider (IdP) and a Service Provider (SP). SAML's mature framework includes well-defined mechanisms for single logout, attribute queries, and cryptographic signing, making it highly suitable for complex enterprise federation scenarios requiring comprehensive identity services.
- ✗
OpenID Connect
Why it's wrong here
OpenID Connect (OIDC) is an authentication layer built on top of the OAuth 2.0 authorization framework, primarily focused on verifying the end-user's identity. While it can convey basic user attributes (claims) via ID tokens, its support for comprehensive attribute exchange and standardized single logout across diverse enterprise environments is less mature and robust compared to SAML. OIDC is often preferred for consumer-facing applications due to its JSON-based simplicity and mobile-friendliness, rather than broad enterprise federation.
- ✗
LDAP
Why it's wrong here
The Lightweight Directory Access Protocol (LDAP) is a protocol for accessing and maintaining distributed directory information services, commonly used for storing user accounts, passwords, and attributes within an organization's internal network. While essential for local authentication and authorization within a single domain, LDAP itself is not a federation protocol. It lacks the inherent mechanisms to securely exchange identity assertions or establish trust relationships between distinct security domains for single sign-on across different organizations.
- ✗
OAuth 2.0
Why it's wrong here
OAuth 2.0 is an authorization framework that enables a third-party application to obtain limited access to a user's protected resources on an HTTP service, without exposing the user's credentials. Its core function is delegated authorization, issuing access tokens that grant specific permissions, rather than authenticating the user directly to the resource server. Consequently, OAuth 2.0 does not inherently provide single sign-on (SSO) or single logout capabilities, which are fundamental requirements for federated identity.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
SAML
Security Assertion Markup Language (SAML) is an open standard that allows one system to securely tell another system that a user is who they say they are, without sharing the user's password.
Key term
Federated identity
Federated identity is a system that allows users to use one set of login credentials across multiple different organizations' systems and websites without needing to create separate accounts.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.