CISSP Identity and Access Management Practice Question
An organization wants to implement single sign-on across multiple web applications using an XML-based protocol that supports identity provider (IdP) and service provider (SP) initiated flows. Which technology should they choose?
⚠ Common exam trap
CISSP often tests the SAML vs OIDC vs OAuth confusion — candidates must remember SAML is XML-based federation with IdP/SP roles, OIDC is JSON/JWT-based authentication, and OAuth 2.0 is authorization only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAML 2.0
SAML 2.0 is the XML-based federation standard that defines both IdP-initiated and SP-initiated SSO flows using assertions, AuthnRequests, and Response messages. It is the classic choice for browser-based SSO across multiple web applications where the identity provider and service provider exchange XML over HTTP POST or redirect bindings. OpenID Connect and OAuth 2.0 are JSON/REST-based, and Kerberos is a ticket-based network authentication protocol, not a web SSO federation standard.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
OpenID Connect
Why it's wrong here
OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 authorization framework, primarily used for user authentication and obtaining basic profile information. While it facilitates single sign-on (SSO), OIDC is fundamentally JSON-based, utilizing JSON Web Tokens (JWTs) for identity assertions, which contrasts with XML-based protocols. It is designed for modern web and mobile applications, often in consumer-facing or API-driven contexts.
- ✗
OAuth 2.0
Why it's wrong here
OAuth 2.0 is an authorization framework, not an authentication protocol, designed to allow a user to grant a third-party application limited access to their resources on another service without sharing their credentials. It primarily uses JSON for data exchange and focuses on delegated authorization rather than directly authenticating a user for single sign-on across multiple enterprise applications. Therefore, it does not fulfill the core requirement of an XML-based SSO solution.
- ✓
SAML 2.0
Why this is correct
SAML 2.0 (Security Assertion Markup Language) is an XML-based standard specifically designed for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It is widely adopted for enterprise single sign-on (SSO) scenarios, enabling users to authenticate once with an IdP and gain seamless access to multiple SPs without re-entering credentials. Its robust support for both IdP-initiated and SP-initiated flows makes it a strong choice for cross-domain SSO implementations.
- ✗
Kerberos
Why it's wrong here
Kerberos is a network authentication protocol that uses secret-key cryptography to provide strong authentication for client/server applications within a trusted domain. While it secures access to network resources by verifying user and service identities, it is not XML-based and is primarily designed for internal network authentication, not web-based, cross-domain single sign-on across disparate organizations or cloud services. Its operational model differs significantly from web-based SSO protocols.
Go deeper
Related to this question
Learn chapter
Cryptography and Its Applications
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.