CISSP Identity and Access Management Practice Question
Which protocol is specifically designed for authorization and not authentication, often using grant types like authorization code and client credentials?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OAuth 2.0
OAuth 2.0 is an authorization framework that provides delegated access; it does not authenticate the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SAML 2.0
Why it's wrong here
SAML 2.0 is an XML-based standard primarily designed for exchanging authentication and authorization data between an identity provider and a service provider, facilitating single sign-on (SSO). While SAML assertions can convey authorization decisions and user attributes, its core function is to establish and communicate a user's authenticated identity across different security domains. It is a comprehensive identity federation protocol, not exclusively focused on delegating specific resource access permissions to third-party applications.
- ✗
OpenID Connect
Why it's wrong here
OpenID Connect (OIDC) is an authentication layer built directly on top of the OAuth 2.0 authorization framework, specifically designed to verify the identity of an end-user. It enables clients to obtain basic profile information about the authenticated user in a standardized, interoperable manner using JSON Web Tokens (JWTs). While OIDC leverages OAuth 2.0 for token issuance, its explicit purpose is user authentication and identity assertion, rather than the delegation of resource access permissions to a third-party application.
- ✗
Kerberos
Why it's wrong here
Kerberos is a robust network authentication protocol that uses secret-key cryptography to provide strong mutual authentication for client/server applications within a trusted domain. It issues encrypted "tickets" that prove a user's identity to a service, thereby granting access based on that verified identity. However, Kerberos's fundamental design is centered on verifying who a user is and establishing secure communication, not on delegating specific, granular authorization permissions to third-party applications without sharing the user's credentials.
- ✓
OAuth 2.0
Why this is correct
OAuth 2.0 is an authorization framework specifically designed to enable a third-party application to obtain limited access to an HTTP service on behalf of a resource owner. It orchestrates an approval interaction where the user grants specific permissions to the application without ever sharing their credentials with it. This protocol's core purpose is the secure delegation of authority for accessing protected resources, making it an authorization framework rather than an authentication protocol for the end-user.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.