Which Protocol Handles Token-Based App Authorization?

SY0-701 By islever Editorial Last updated

Short answer

D OAuth

Question

An organization has recently decided to implement SSO. The requirements are to leverage access tokens and focus on application authorization rather than user authentication. Which of the following solutions would the engineering team most likely configure?
  1. LDAP
  2. Federation
  3. SAML
  4. OAuth Correct Answer

Key Takeaways

The question assesses whether you can distinguish authentication frameworks from authorization protocols, with the primary trap being the assumption that all SSO standards handle resource access equally.

This SY0-701 practice question evaluates your understanding of authorization versus authentication protocols within SSO architectures. Experts and candidates consistently identify OAuth as the definitive solution for token-driven application access delegation.

Common mistake: Many test-takers incorrectly choose SAML because it is heavily marketed for enterprise SSO; however, SAML transmits authentication assertions rather than managing scoped access tokens for third-party applications.

Expert Analysis

Why the Answer Is Correct

OAuth 2.0 is explicitly designed as an authorization framework that issues access tokens to grant limited permissions to applications without exposing user credentials. By leveraging these tokens, organizations can delegate resource access securely while maintaining strict control over application-level permissions. This aligns perfectly with the requirement to prioritize application authorization over user authentication in an SSO deployment.

Why the Other Options Are Wrong

LDAP functions as a directory service protocol primarily used for centralized user authentication and credential verification, not token-based authorization. SAML is an XML-based standard optimized for exchanging authentication and role data between identity providers and service providers, making it ideal for login SSO but less suited for granular API authorization. Federation describes the overarching trust relationship between domains rather than a specific token-handling mechanism, leaving it too broad for this technical requirement.

Community Comment Notes

Comment [1] correctly highlights that modern web applications and APIs strongly favor OAuth for authorization tasks. Comment [2] reinforces this by noting OAuth’s core purpose of enabling resource access without credential sharing. Comment [3] provides the exact RFC-style definition of OAuth 2.0, confirming its role in orchestrating approval interactions for HTTP services. These insights collectively validate the engineering team’s decision to deploy OAuth for token-driven authorization.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When encountering SSO-related questions, immediately scan for keywords like “tokens,” “delegation,” or “application access” to trigger OAuth, whereas “login,” “identity assertion,” or “XML” points toward SAML. Memorizing the distinct roles of IAM protocols will prevent costly misreads during the exam.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. 9149f41 👍 4 Answered D
    For modern web applications and APIs: OAuth is preferred for authorization SAML is preferred for authentication LDAP is often used more for internal network resources and directory services
  2. BevMe 👍 2 Answered D
    OAuth is designed to allow applications to access resources on behalf of a user without needing to share credentials.
  3. 0ca8ee9 👍 1 Answered D
    OAuth 2.0 is an authorization framework that enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service, or by allowing the third-party application to obtain access on its own behalf.
  4. s_plus 👍 1
    Lightweight Directory Access Protocol Security Assertion Markup Language *Open Authorization

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide