CISSP Practice Question: Which TWO protocols are commonly used for…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  LDAP

  Why it's wrong here

  LDAP (Lightweight Directory Access Protocol) is primarily used for accessing and maintaining distributed directory information services, such as user accounts and group memberships within a single organization's network. While it stores identity data, it does not provide a mechanism for securely exchanging authentication or authorization assertions between disparate identity providers and service providers across different trust domains, which is the core function of identity federation.

• ✗

  OAuth 2.0

  Why it's wrong here

  OAuth 2.0 is an authorization framework that enables a user to grant a third-party application limited access to protected resources on an HTTP service, without sharing their credentials. It focuses on delegated authorization, allowing applications to act on behalf of the user. While foundational for many modern identity systems, OAuth 2.0 itself does not define how a user's identity is verified or asserted across different security domains, which is the primary concern of an identity federation protocol.

• ✓

  OpenID Connect

  Why this is correct

  OpenID Connect (OIDC) is an identity layer built on top of the OAuth 2.0 framework, specifically designed for federated authentication. It allows clients to verify the identity of the end-user based on the authentication performed by an authorization server and to obtain basic profile information about the end-user in an interoperable REST-like manner. OIDC issues ID Tokens, which are JSON Web Tokens (JWTs) containing verifiable claims about the authenticated user, facilitating single sign-on across multiple services.

• ✗

  RADIUS

  Why it's wrong here

  RADIUS (Remote Authentication Dial-In User Service) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users connecting to a network service. It is primarily used for authenticating users for network access, such as VPNs or Wi-Fi, against a central directory within a single administrative domain. RADIUS does not facilitate the secure exchange of identity assertions or authentication decisions between distinct organizations or trust boundaries, which is the hallmark of identity federation.

• ✓

  SAML 2.0

  Why this is correct

  SAML 2.0 (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables web-based single sign-on (SSO) by allowing an IdP to assert a user's identity and attributes to an SP, eliminating the need for the user to re-authenticate directly with each service. SAML is widely adopted in enterprise environments for federated access management, securely bridging trust between different security domains.

Go deeper

Related to this question