Study. uk . com
  1. Home
  2. All questions
  3. Question 353

CISSP study material · question 353 of 500

An application has a server-side component that can hold a secret and a browser component that cannot. What does RFC 6749 recommend when the authorization server offers no explicit support for such clients?

  1. Do not register it, since distributed clients fall outside the framework.
  2. Register the whole application as confidential, since one component can hold a secret.
  3. Register each component as a separate client, since each has a different security context.
  4. Register the whole application as public, since the weakest component decides.
Show the answer

Answer: C. Register each component as a separate client, since each has a different security context.

A client may be a distributed set of components with different types and security contexts; each should be registered separately where the server gives no guidance.

Source: RFC 6749 (IETF) — RFC 6749 > 2.1 Client Types

Challenge yourself on this topic → Study as cards