CISSP Identity and Access Management Practice Question
Which protocol is specifically designed for authorization and not authentication, often using grant types like authorization code and client credentials?
⚠ Common exam trap
CISSP often tests the OAuth-versus-OIDC confusion, and the trap is selecting OpenID Connect because candidates conflate 'authorization' with 'authentication' and forget that OIDC is the authentication layer built on OAuth.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OAuth 2.0
OAuth 2.0 is an authorization framework, not an authentication protocol, and it defines grant types such as authorization code, client credentials, implicit, and resource owner password credentials. It issues access tokens that grant scoped permissions to resources, deliberately leaving user identity verification to other layers. This is why OAuth 2.0 is the correct answer for a protocol designed specifically for authorization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SAML 2.0
Why it's wrong here
SAML 2.0 is an XML-based standard primarily designed for exchanging authentication and authorization data between an identity provider and a service provider, facilitating single sign-on (SSO). While SAML assertions can convey authorization decisions and user attributes, its core function is to establish and communicate a user's authenticated identity across different security domains. It is a comprehensive identity federation protocol, not exclusively focused on delegating specific resource access permissions to third-party applications.
- ✗
OpenID Connect
Why it's wrong here
OpenID Connect (OIDC) is an authentication layer built directly on top of the OAuth 2.0 authorization framework, specifically designed to verify the identity of an end-user. It enables clients to obtain basic profile information about the authenticated user in a standardized, interoperable manner using JSON Web Tokens (JWTs). While OIDC leverages OAuth 2.0 for token issuance, its explicit purpose is user authentication and identity assertion, rather than the delegation of resource access permissions to a third-party application.
- ✗
Kerberos
Why it's wrong here
Kerberos is a robust network authentication protocol that uses secret-key cryptography to provide strong mutual authentication for client/server applications within a trusted domain. It issues encrypted "tickets" that prove a user's identity to a service, thereby granting access based on that verified identity. However, Kerberos's fundamental design is centered on verifying who a user is and establishing secure communication, not on delegating specific, granular authorization permissions to third-party applications without sharing the user's credentials.
- ✓
OAuth 2.0
Why this is correct
OAuth 2.0 is an authorization framework specifically designed to enable a third-party application to obtain limited access to an HTTP service on behalf of a resource owner. It orchestrates an approval interaction where the user grants specific permissions to the application without ever sharing their credentials with it. This protocol's core purpose is the secure delegation of authority for accessing protected resources, making it an authorization framework rather than an authentication protocol for the end-user.
Go deeper
Related to this question
Learn chapter
Legal, Regulatory, and Compliance Issues
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
OAuth
OAuth is an open standard for access delegation that allows users to grant third-party applications limited access to their resources without sharing their credentials.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.