CISSP Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  OAuth

  Why it's wrong here

  OAuth (Open Authorization) is an open standard for delegated authorization, allowing a user to grant a third-party application limited access to their resources on another service without sharing their primary credentials. It defines how clients obtain an access token from an authorization server to access protected resources on a resource server. This protocol is fundamentally designed for resource access delegation and consent management, not for querying or managing entries within a centralized directory service.

• ✓

  LDAP

  Why this is correct

  LDAP (Lightweight Directory Access Protocol) is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. It provides a standardized method for clients to query and update information in a directory, such as user accounts, groups, and network resources. Its "lightweight" designation refers to its streamlined design compared to its predecessor, X.500 DAP, making it efficient for common directory operations.

• ✗

  Kerberos

  Why it's wrong here

  Kerberos is a network authentication protocol that works on the basis of "tickets" to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. It primarily focuses on strong mutual authentication between a client and a server, preventing eavesdropping and replay attacks by using a trusted third party (Key Distribution Center). While it often integrates with directory services to retrieve user principal names, its core function is session authentication, not querying or managing directory entries directly.

• ✗

  SAML

  Why it's wrong here

  SAML (Security Assertion Markup Language) is an XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider. It enables single sign-on (SSO) across disparate security domains by asserting a user's identity and attributes, allowing a user authenticated once to access multiple applications. SAML is primarily concerned with federated identity management and conveying security assertions, rather than providing a direct interface for querying or modifying a directory's contents.

Go deeper

Related to this question