CISSP Identity and Access Management Practice Question
An organization wants to implement single sign-on across multiple web applications using an XML-based protocol that supports identity provider (IdP) and service provider (SP) initiated flows. Which technology should they choose?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAML 2.0
SAML 2.0 is an XML-based protocol for SSO that supports both IdP and SP initiated flows and uses assertions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
OpenID Connect
Why it's wrong here
OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 authorization framework, primarily used for user authentication and obtaining basic profile information. While it facilitates single sign-on (SSO), OIDC is fundamentally JSON-based, utilizing JSON Web Tokens (JWTs) for identity assertions, which contrasts with XML-based protocols. It is designed for modern web and mobile applications, often in consumer-facing or API-driven contexts.
- ✗
OAuth 2.0
Why it's wrong here
OAuth 2.0 is an authorization framework, not an authentication protocol, designed to allow a user to grant a third-party application limited access to their resources on another service without sharing their credentials. It primarily uses JSON for data exchange and focuses on delegated authorization rather than directly authenticating a user for single sign-on across multiple enterprise applications. Therefore, it does not fulfill the core requirement of an XML-based SSO solution.
- ✓
SAML 2.0
Why this is correct
SAML 2.0 (Security Assertion Markup Language) is an XML-based standard specifically designed for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It is widely adopted for enterprise single sign-on (SSO) scenarios, enabling users to authenticate once with an IdP and gain seamless access to multiple SPs without re-entering credentials. Its robust support for both IdP-initiated and SP-initiated flows makes it a strong choice for cross-domain SSO implementations.
- ✗
Kerberos
Why it's wrong here
Kerberos is a network authentication protocol that uses secret-key cryptography to provide strong authentication for client/server applications within a trusted domain. While it secures access to network resources by verifying user and service identities, it is not XML-based and is primarily designed for internal network authentication, not web-based, cross-domain single sign-on across disparate organizations or cloud services. Its operational model differs significantly from web-based SSO protocols.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.