CISSP Identity and Access Management Practice Question
An organization is implementing OpenID Connect (OIDC) for authentication. Which THREE of the following are components of OIDC? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization code flow
OIDC uses ID token, UserInfo endpoint, and OAuth 2.0 authorization framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authorization code flow
Why this is correct
The Authorization Code flow is the most secure and widely recommended OAuth 2.0 flow for confidential clients, such as web applications, within OpenID Connect. It involves the client redirecting the user's browser to the authorization server, receiving a temporary authorization code, and then exchanging this code directly with the authorization server's token endpoint for ID and access tokens. This method prevents sensitive tokens from being exposed in the user's browser or URL, enhancing security significantly.
- ✗
Kerberos ticket granting ticket
Why it's wrong here
Kerberos is a network authentication protocol that uses symmetric-key cryptography to provide strong authentication for client/server applications within a trusted realm, typically an enterprise environment. A Ticket Granting Ticket (TGT) is issued by a Key Distribution Center (KDC) to a client, allowing it to request service tickets without re-authenticating for each service. This protocol is fundamentally distinct from OpenID Connect, which is an identity layer built on OAuth 2.0 for federated identity over HTTP, primarily for web and mobile applications.
- ✓
UserInfo endpoint
Why this is correct
The UserInfo endpoint is a protected resource in OpenID Connect that allows a Relying Party (client application) to retrieve additional claims about the authenticated end-user. After obtaining an access token, the client can make a request to this endpoint to receive a JSON response containing user attributes like name, email, or profile picture. This provides a flexible mechanism to fetch user details that might not be included in the ID Token due to size constraints or specific privacy requirements.
- ✗
SAML assertion
Why it's wrong here
SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider, primarily used for web-based single sign-on. A SAML assertion is an XML document containing statements about a subject, such as authentication status or attributes. While it serves a similar purpose of identity federation, SAML is a separate and distinct protocol from OpenID Connect, which uses JSON Web Tokens (JWTs) and is built on OAuth 2.0.
- ✓
ID token
Why this is correct
The ID Token is a core component of OpenID Connect, issued by the Authorization Server to the Relying Party (client application) as proof of the end-user's authentication. It is a JSON Web Token (JWT) that contains verifiable claims about the user, such as their unique identifier (`sub`), the issuer (`iss`), the audience (`aud`), and its expiration time (`exp`). The client can cryptographically validate this token to confirm the user's identity and the token's integrity.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.