CISSP Identity and Access Management Practice Question
OpenID Connect (OIDC) extends OAuth 2.0 primarily by adding which capability?
⚠ Common exam trap
It's easy for candidates to confuse OAuth 2.0's authorization delegation (access tokens for resources) with OIDC's authentication (ID tokens for user identity), leading them to incorrectly select 'Authorization delegation' as the primary addition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User authentication
OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that primarily adds user authentication. While OAuth 2.0 provides authorization delegation (access tokens for resources), OIDC introduces an ID token (a JSON Web Token, JWT) that contains claims about the authenticated user, enabling the client to verify the user's identity. This is defined in the OIDC specification (OpenID Foundation) and is the key differentiator from plain OAuth 2.0.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client credential management
Why it's wrong here
OIDC does not primarily extend OAuth 2.0 by adding client credential management. OAuth 2.0 already defines robust mechanisms for clients to authenticate themselves to the authorization server, typically using a `client_id` and `client_secret`, or more advanced methods like mTLS. OIDC builds upon this existing client authentication framework provided by OAuth 2.0, focusing instead on standardizing the end-user's identity verification.
- ✗
Authorization delegation
Why it's wrong here
Authorization delegation is the fundamental purpose of OAuth 2.0, enabling a client application to access a user's protected resources on a resource server with the user's explicit consent, without ever sharing the user's credentials with the client. OIDC does not introduce this capability; rather, it relies on OAuth 2.0's established framework for securely delegating authorization from the resource owner to a client application.
- ✗
Token introspection
Why it's wrong here
Token introspection is an OAuth 2.0 extension (RFC 7662) that allows a resource server to query an authorization server about the active state and metadata of an access token. While OIDC relies on access tokens for authorization, the introspection mechanism itself is a separate, general OAuth 2.0 capability for token validation, not a primary feature OIDC adds to enable user authentication. OIDC's core contribution is the ID Token for identity verification.
- ✓
User authentication
Why this is correct
OpenID Connect (OIDC) primarily extends OAuth 2.0 by adding a standardized layer for user authentication. While OAuth 2.0 focuses solely on authorization, allowing a client to obtain delegated access to protected resources, OIDC introduces the concept of an ID Token. This ID Token, a JSON Web Token (JWT), provides verifiable claims about the authenticated user, enabling the client application to confirm the user's identity and retrieve basic profile information.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.