CISSP Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  OAuth 2.0 supports device code grant, OIDC does not

  Why it's wrong here

  This statement is incorrect because OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 authorization framework. As such, OIDC can leverage any of the OAuth 2.0 grant types, including the device code grant, which is specifically designed for input-constrained devices. OIDC uses these underlying OAuth 2.0 flows to facilitate user authentication and identity verification.

• ✓

  OAuth 2.0 is for authorization, while OIDC is for authentication

  Why this is correct

  This statement is correct and highlights a fundamental distinction. OAuth 2.0 is an authorization framework, primarily concerned with granting delegated access to protected resources without sharing user credentials. Conversely, OpenID Connect (OIDC) is an authentication protocol built on OAuth 2.0, specifically designed to verify the identity of an end-user and obtain basic profile information, issuing an ID Token for this purpose.

• ✗

  OIDC is XML-based, while OAuth 2.0 is JSON-based

  Why it's wrong here

  This statement is incorrect. Both OAuth 2.0 and OpenID Connect (OIDC) predominantly utilize JSON (JavaScript Object Notation) for data exchange, including requests, responses, and token formats. XML is a data format more commonly associated with older federation standards like SAML (Security Assertion Markup Language), not these modern, lightweight protocols.

• ✓

  OIDC uses JSON Web Tokens (JWT) for ID tokens, while OAuth 2.0 does not define a token format

  Why this is correct

  This statement is correct. OpenID Connect (OIDC) explicitly mandates the use of JSON Web Tokens (JWTs) for its ID Tokens, which carry verifiable claims about the authenticated user's identity. In contrast, OAuth 2.0 deliberately leaves the format of its Access Tokens opaque and undefined, allowing for various implementations such as bearer tokens, reference tokens, or even JWTs, without prescribing a specific structure.

• ✗

  OAuth 2.0 requires a client secret, OIDC does not

  Why it's wrong here

  This statement is incorrect. Both OAuth 2.0 and OpenID Connect (OIDC) support client secrets, depending on the client type. Confidential clients, typically server-side applications, are capable of securely storing a client secret and are required to use one for authentication. Public clients, such as mobile or single-page applications, cannot securely store a secret and therefore do not use one, relying on other authentication methods.

Go deeper

Related to this question