CISSP Identity and Access Management Practice Question
An organization is implementing OpenID Connect (OIDC) for authentication. Which THREE of the following are components of OIDC? (Choose three.)
⚠ Common exam trap
CISSP often tests the confusion between OIDC and other authentication protocols like SAML and Kerberos, leading candidates to select SAML assertion or Kerberos TGT as OIDC components.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization code flow
OIDC defines the Authorization Code Flow (option A) as one of its core authentication flows, where the client exchanges an authorization code at the token endpoint for an ID token and access token, making it a standard OIDC component. The UserInfo endpoint (option C) is a defined OIDC endpoint that returns claims about the authenticated end-user when presented with a valid access token, so it is part of the OIDC specification. The ID token (option E) is the central OIDC artifact—a signed JWT containing authentication claims such as iss, sub, aud, exp, and iat—that proves the user's identity to the client. Kerberos ticket granting tickets (option B) belong to the Kerberos protocol, not OIDC, and SAML assertions (option D) are part of the SAML 2.0 standard, which is a separate federation protocol from OIDC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authorization code flow
Why this is correct
The Authorization Code flow is the most secure and widely recommended OAuth 2.0 flow for confidential clients, such as web applications, within OpenID Connect. It involves the client redirecting the user's browser to the authorization server, receiving a temporary authorization code, and then exchanging this code directly with the authorization server's token endpoint for ID and access tokens. This method prevents sensitive tokens from being exposed in the user's browser or URL, enhancing security significantly.
- ✗
Kerberos ticket granting ticket
Why it's wrong here
Kerberos is a network authentication protocol that uses symmetric-key cryptography to provide strong authentication for client/server applications within a trusted realm, typically an enterprise environment. A Ticket Granting Ticket (TGT) is issued by a Key Distribution Center (KDC) to a client, allowing it to request service tickets without re-authenticating for each service. This protocol is fundamentally distinct from OpenID Connect, which is an identity layer built on OAuth 2.0 for federated identity over HTTP, primarily for web and mobile applications.
- ✓
UserInfo endpoint
Why this is correct
The UserInfo endpoint is a protected resource in OpenID Connect that allows a Relying Party (client application) to retrieve additional claims about the authenticated end-user. After obtaining an access token, the client can make a request to this endpoint to receive a JSON response containing user attributes like name, email, or profile picture. This provides a flexible mechanism to fetch user details that might not be included in the ID Token due to size constraints or specific privacy requirements.
- ✗
SAML assertion
Why it's wrong here
SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider, primarily used for web-based single sign-on. A SAML assertion is an XML document containing statements about a subject, such as authentication status or attributes. While it serves a similar purpose of identity federation, SAML is a separate and distinct protocol from OpenID Connect, which uses JSON Web Tokens (JWTs) and is built on OAuth 2.0.
- ✓
ID token
Why this is correct
The ID Token is a core component of OpenID Connect, issued by the Authorization Server to the Relying Party (client application) as proof of the end-user's authentication. It is a JSON Web Token (JWT) that contains verifiable claims about the user, such as their unique identifier (`sub`), the issuer (`iss`), the audience (`aud`), and its expiration time (`exp`). The client can cryptographically validate this token to confirm the user's identity and the token's integrity.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Kerberos
Kerberos is a network authentication protocol that uses tickets and symmetric-key cryptography to verify the identity of users and services in a secure, non-repudiable way.
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.