ExamworthyExamworthy
Open the appStart free

CISSP - Identity and Access Management (IAM) - Section 5.3

Implement and manage federated identity with a third-party service, on-premise, in the cloud, or hybrid.

Implement federated identity by configuring trust relationships between identity providers and service providers using SAML, OAuth, and OpenID Connect across on-premises, cloud, and hybrid environments. Distinguish the roles of identity provider, service provider, and relying party and recognise the risks introduced by cross-domain federation.

federationSAMLOAuthOpenID Connectidentity provider

Practice question for this objective

Free sampleIdentity and Access Management (IAM)medium

An identity architect is choosing between SAML 2.0 and OpenID Connect for a new customer-facing single sign-on integration with a mix of mobile apps and traditional web applications. Which statement about the relationship between SAML, OAuth 2.0, and OpenID Connect is correct and BEST informs the choice?

  • ASAML 2.0 is the modern replacement for OAuth 2.0 and OpenID Connect because it supports both authentication and authorisation in a single XML assertion suitable for native mobile clients.
  • BOAuth 2.0 is an authentication protocol that issues identity tokens, and OpenID Connect is an extension that adds authorisation scopes on top of those tokens.
  • CSAML, OAuth 2.0, and OpenID Connect are interchangeable wire formats for the same federation messages, and the choice is determined only by which signing algorithm the identity provider supports.
  • DOpenID Connect is an identity layer built on top of OAuth 2.0 that returns a signed ID token, while SAML 2.0 is a self-contained XML-based assertion framework that predates OAuth. Correct
Distinguish SAML, OAuth 2.0, and OpenID Connect by recognising that OIDC is an authentication layer on top of the OAuth 2.0 authorisation framework. SAML 2.0, ratified in 2005, is an XML-based standard that bundles authentication assertions, attribute statements, and protocol bindings (HTTP-Redirect, HTTP-POST, Artifact) into one framework, and remains common for enterprise web SSO. OAuth 2.0 is an authorisation framework that issues access tokens delegating limited access to resources. OpenID Connect, layered on OAuth 2.0, adds an ID token (a JWT signed by the identity provider) and a UserInfo endpoint so the relying party can authenticate the end user. Understanding that OIDC is authentication on top of OAuth 2.0 is the canonical distinction tested at this level.

Why A is wrong: This inverts the timeline and the fit-for-purpose answer. SAML predates OAuth and OpenID Connect, and its XML payloads and browser-based bindings are awkward for native mobile clients, which is precisely why OpenID Connect emerged.

Why B is wrong: This reverses the protocols' purposes. OAuth 2.0 is an authorisation framework that issues access tokens for resource access, and OpenID Connect is the layer that adds authentication and an ID token. Treating OAuth as an authentication protocol is a well-known antipattern.

Why C is wrong: These protocols differ in transport bindings, token formats, intended use cases, and trust models. They are not interchangeable encodings, and reducing the choice to signing algorithms ignores fundamental architectural differences.

Why D is correct: OpenID Connect extends the OAuth 2.0 authorisation framework with an ID token (a signed JWT) and a standardised UserInfo endpoint, giving authentication semantics on top of OAuth. SAML 2.0 is an older, self-contained XML protocol that bundles authentication, attribute exchange, and protocol bindings in one specification.

See more CISSP practice questions, answers explained.

More in this domain

Back to all Identity and Access Management (IAM) objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.