mediumMultiple ChoiceObjective-mapped
CISSP Uses OAuth 2.0 for delegated access to APIs Practice Question
An organization uses OAuth 2.0 for delegated access to APIs. A developer creates a public client application that runs on mobile devices. Which OAuth 2.0 grant type is MOST appropriate for this scenario?
⚠ Common exam trap
It's easy for candidates to choose the Implicit Grant (Option B) because they mistakenly believe it is simpler for mobile apps, but the CISSP exam tests the current OAuth 2.0 Security BCP which deprecates Implicit and mandates PKCE for public clients.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization Code Grant with PKCE
The Authorization Code Grant with PKCE (Proof Key for Code Exchange) is the most appropriate for a public client on a mobile device because it prevents authorization code interception attacks. PKCE replaces the client secret with a dynamically generated code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This is the OAuth 2.0 Security Best Current Practice (BCP) recommendation for native and mobile apps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client Credentials Grant
Why it's wrong here
The Client Credentials Grant is specifically designed for machine-to-machine authentication, where the client application itself is the resource owner or acts on its own behalf, rather than on behalf of an end-user. It allows the client to obtain an access token directly from the authorization server using its own registered credentials, making it unsuitable for scenarios requiring a user to delegate access to their personal resources.
- ✗
Implicit Grant
Why it's wrong here
The Implicit Grant is largely deprecated due to significant security vulnerabilities, primarily exposing access tokens directly in the URL fragment, which can be logged by browsers or proxies. It also lacks the ability to issue refresh tokens, necessitating frequent re-authentication for long-lived sessions and making it particularly insecure for public clients like single-page applications or mobile apps where the client secret cannot be securely stored.
- ✗
Resource Owner Password Credentials Grant
Why it's wrong here
The Resource Owner Password Credentials Grant requires the client application to directly collect and handle the user's username and password, then send them to the authorization server. This practice is highly discouraged as it bypasses the authorization server's secure login page, forcing the user to trust the client application with their sensitive credentials and significantly increasing the risk of credential compromise if the client is malicious or breached.
- ✓
Authorization Code Grant with PKCE
Why this is correct
The Authorization Code Grant with Proof Key for Code Exchange (PKCE) is the recommended flow for public clients, such as mobile or single-page applications, that cannot securely store a client secret. PKCE mitigates the authorization code interception attack by requiring the client to generate a unique `code_verifier` and send a `code_challenge` during the initial authorization request, then prove possession of the `code_verifier` when exchanging the authorization code for an access token, ensuring only the legitimate client can complete the token exchange.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.