Describe the Steps in the OAuth2 Three-Legged Authorization Code Grant Flow 350-901 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What should the client do with the state parameter value it receives in the redirect back from the authorization server?

   • AIgnore it because it is only for the authorization server's use
   • BCompare it to the state value it sent in the original authorization request
   • CStore it as the access token for future API calls
   • DSend it to the resource server for validation
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A user is trying to authorize a third-party app to access their data. They are redirected to the authorization server, but instead of seeing a login page, they see an error saying 'Invalid redirect_uri'. What is the most likely cause of this error?

   • AThe redirect_uri does not exactly match a pre-registered URI for the client
   • BThe client_id is incorrect
   • CThe user's credentials are incorrect
   • DThe scope parameter is invalid
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An OAuth2 authorization server is being configured to support multiple client applications. A security auditor warns that the server must prevent open redirect vulnerabilities. What is the most effective measure the authorization server should implement?

   • AValidate the redirect_uri parameter against a pre-registered list of exact URIs for the client
   • BAllow any redirect URI that contains the client's registered domain as a substring
   • CRequire all clients to use HTTPS for their redirect URIs
   • DRedirect the user to a generic error page if the redirect_uri is not recognized
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   After the resource owner grants consent, how does the authorization server deliver the authorization code to the client?

   • AIt returns the code in the body of the original authorization request response
   • BIt redirects the user agent to the client's redirect_uri with the code as a query parameter
   • CIt embeds the code in a cookie set on the user's browser
   • DIt sends the code directly to the client's server via a POST request
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of the refresh_token in the token response?

   • ATo identify the client to the resource server
   • BTo provide a backup access token if the primary one is rejected
   • CTo allow the client to obtain a new access token without user interaction when the current one expires
   • DTo allow the resource server to validate the access token
   Reveal Solution Discussion Select an answer first