CISSP Identity and Access Management Practice Question
An organization wants to enable single sign-on (SSO) across multiple web applications using an XML-based protocol that supports browser redirect flows. Which technology is most appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAML 2.0
SAML 2.0 is XML-based and uses browser redirects for SSO between IdP and SPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kerberos
Why it's wrong here
Kerberos relies on a ticket-granting system and requires the client and server to share a trusted Key Distribution Center (KDC), which does not natively support browser-based HTTP redirect flows for cross-domain web applications; the correct technology uses SAML assertions carried via HTTP redirects. It is tempting because Kerberos provides strong, centralised authentication in a Windows domain environment, and would be the correct choice for on-premises network services where all participants are in the same Active Directory forest using Microsoft Entra ID.
- ✗
OAuth 2.0
Why it's wrong here
OAuth 2.0 is an authorization framework designed to enable a third-party application to obtain limited access to an HTTP service on behalf of a resource owner. It focuses on delegated access, allowing users to grant applications access to their information on other sites without sharing their credentials directly. While it uses JSON for data exchange, it does not provide an identity layer for single sign-on across disparate systems, making it unsuitable for direct authentication.
- ✗
OpenID Connect (OIDC)
Why it's wrong here
OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 framework, specifically designed to enable clients to verify the identity of the end-user based on the authentication performed by an authorization server. It provides single sign-on capabilities and uses JSON Web Tokens (JWTs) for identity information, making it a modern, lightweight, and mobile-friendly solution. However, unlike SAML 2.0, OIDC is JSON-based and relies on the OAuth 2.0 authorization flows, which might not align with existing enterprise systems or requirements that traditionally leverage XML for browser-based SSO.
- ✓
SAML 2.0
Why this is correct
SAML 2.0 (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. It is specifically designed to facilitate browser-based single sign-on (SSO) for web applications across different security domains, allowing users to authenticate once and gain access to multiple services without re-entering credentials. Its robust support for federated identity management makes it a cornerstone for enterprise SSO solutions.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.