CISSP Identity and Access Management Practice Question
In an OAuth 2.0 authorization code flow with PKCE, what is the primary purpose of the code verifier and code challenge?
⚠ Common exam trap
The trap is assuming PKCE encrypts the authorization code or authenticates the user; candidates who don't understand that PKCE binds the code to the requesting client pick options about encryption or user authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To ensure the client that requested the code is the same one redeeming it
In OAuth 2.0 authorization code flow with PKCE, the code verifier and code challenge are used to prove that the client redeeming the authorization code is the same client that initiated the authorization request. The client generates a random code verifier, hashes it to create the code challenge, sends the challenge with the authorization request, and later sends the verifier with the token request — the authorization server verifies they match. This prevents authorization code interception attacks, especially for public clients.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To encrypt the authorization code
Why it's wrong here
PKCE (Proof Key for Code Exchange) does not encrypt the authorization code. Its primary function is to bind the authorization code to the specific client that initiated the flow, preventing interception attacks where a malicious client might steal and redeem the code. While the authorization code is typically transmitted over a secure channel (TLS), PKCE adds an additional layer of security by ensuring the *identity* of the redeeming client, not the confidentiality of the code itself.
- ✗
To authenticate the end user
Why it's wrong here
PKCE is not involved in authenticating the end user. User authentication is a distinct process handled by the authorization server, which verifies the user's credentials and consent before issuing an authorization code to the client. PKCE's role begins *after* user authentication, focusing on securing the subsequent exchange of the authorization code for an access token between the client and the authorization server, ensuring the integrity of that specific transaction.
- ✓
To ensure the client that requested the code is the same one redeeming it
Why this is correct
This statement accurately describes the core purpose of PKCE. By requiring the client to generate a `code_verifier` and send a transformed `code_challenge` at the beginning of the flow, then present the original `code_verifier` when redeeming the authorization code, PKCE ensures that only the client that initiated the request can successfully exchange the code for tokens. This mechanism effectively prevents authorization code interception attacks, where a malicious application might steal the code and impersonate the legitimate client.
- ✗
To generate the ID token
Why it's wrong here
PKCE is an extension specifically designed for the OAuth 2.0 authorization code flow to enhance security for public clients. ID tokens, however, are a fundamental component of OpenID Connect (OIDC), which is an identity layer built on top of OAuth 2.0. OIDC uses ID tokens to convey information about the authenticated end-user to the client, a function entirely separate from PKCE's role in securing the authorization code exchange.
Go deeper
Related to this question
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.