CISSP Identity and Access Management Practice Question
In an OAuth 2.0 authorization code flow with PKCE, what is the primary purpose of the code verifier and code challenge?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To ensure the client that requested the code is the same one redeeming it
PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks, especially for public clients like mobile apps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To encrypt the authorization code
Why it's wrong here
PKCE (Proof Key for Code Exchange) does not encrypt the authorization code. Its primary function is to bind the authorization code to the specific client that initiated the flow, preventing interception attacks where a malicious client might steal and redeem the code. While the authorization code is typically transmitted over a secure channel (TLS), PKCE adds an additional layer of security by ensuring the *identity* of the redeeming client, not the confidentiality of the code itself.
- ✗
To authenticate the end user
Why it's wrong here
PKCE is not involved in authenticating the end user. User authentication is a distinct process handled by the authorization server, which verifies the user's credentials and consent before issuing an authorization code to the client. PKCE's role begins *after* user authentication, focusing on securing the subsequent exchange of the authorization code for an access token between the client and the authorization server, ensuring the integrity of that specific transaction.
- ✓
To ensure the client that requested the code is the same one redeeming it
Why this is correct
This statement accurately describes the core purpose of PKCE. By requiring the client to generate a `code_verifier` and send a transformed `code_challenge` at the beginning of the flow, then present the original `code_verifier` when redeeming the authorization code, PKCE ensures that only the client that initiated the request can successfully exchange the code for tokens. This mechanism effectively prevents authorization code interception attacks, where a malicious application might steal the code and impersonate the legitimate client.
- ✗
To generate the ID token
Why it's wrong here
PKCE is an extension specifically designed for the OAuth 2.0 authorization code flow to enhance security for public clients. ID tokens, however, are a fundamental component of OpenID Connect (OIDC), which is an identity layer built on top of OAuth 2.0. OIDC uses ID tokens to convey information about the authenticated end-user to the client, a function entirely separate from PKCE's role in securing the authorization code exchange.
Go deeper
Related to this question
Learn chapter
Asset Security: Classification and Handling
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.