CISSP Identity and Access Management Practice Question
Which OAuth 2.0 grant type is recommended for a public client (e.g., single-page application) that cannot securely store a client secret?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization code grant with PKCE
The authorization code grant with PKCE (Proof Key for Code Exchange) is designed for public clients to prevent interception of the authorization code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Resource owner password credentials grant
Why it's wrong here
This grant type directly exposes the user's credentials (username and password) to the client application, which then passes them to the authorization server. For public clients, which cannot guarantee the confidentiality of client secrets or securely store user passwords, this presents a significant security risk. It bypasses the authorization server's user interface, making it vulnerable to phishing and credential compromise, and is therefore strongly discouraged.
- ✓
Authorization code grant with PKCE
Why this is correct
The Authorization Code Grant with Proof Key for Code Exchange (PKCE) is the recommended flow for public clients, such as mobile and single-page applications. PKCE mitigates the authorization code interception attack by requiring the client to generate a cryptographically random `code_verifier` and a `code_challenge` derived from it. This ensures that only the legitimate client that initiated the authorization request can exchange the authorization code for an access token, even if the code is intercepted.
- ✗
Implicit grant
Why it's wrong here
The Implicit Grant is deprecated due to its inherent security weaknesses, primarily the direct exposure of access tokens in the URL fragment. This makes tokens susceptible to leakage via browser history, referrer headers, and various injection attacks. Furthermore, it does not support refresh tokens, requiring users to re-authenticate frequently, and lacks client authentication, making it less secure than the Authorization Code flow.
- ✗
Client credentials grant
Why it's wrong here
The Client Credentials Grant is designed exclusively for confidential clients to obtain an access token on their own behalf, without any user involvement. It is used for machine-to-machine communication where the client itself is the resource owner, or acts on its own behalf. Public clients, by definition, cannot securely store a client secret, which is a fundamental requirement for this grant type, rendering it unsuitable for user-facing applications.
Go deeper
Related to this question
Learn chapter
Software Development Security
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.