The correct answer is OpenID Connect.

OpenID Connect is an identity layer that builds on the OAuth 2.0 authorization framework and it is specifically designed to provide user authentication for web and mobile applications. It issues an ID token typically as a JSON Web Token and it uses OAuth 2.0 flows for consent and token exchange so third party web applications can verify user identity securely.

SAML 2.0 is an XML based federation protocol that provides single sign on and authentication assertions but it is not built on top of OAuth 2.0 and it does not use the OAuth ID token model, so it does not match the requirement in this question.

Google Cloud Identity is a cloud identity management service and product rather than an authentication protocol built on OAuth 2.0, so it is not the protocol asked for here.

WS-Federation is a Microsoft claims based federation protocol used in some legacy enterprise scenarios and it is not implemented on top of OAuth 2.0. It is increasingly superseded by modern standards like OpenID Connect and it is less likely to be the intended answer on newer exams.

Full AWS Practitioner Certification Question