A user has authorized a third-party application to access their calendar. The access token expires after one hour. The application needs to continue accessing the calendar for several days without requiring the user to re-authenticate. What should the application do?

Extend the access token's expiration time in the token request

Request a new authorization code every time the access token expires

Store the user's password and re-authenticate automatically

Use the refresh token to obtain a new access token when the current one expires

In the authorization code grant flow, what is the correct sequence after the client redirects the resource owner to the authorization server?

User authenticates → user consents → authorization server redirects with code → client exchanges code for token

User consents → user authenticates → client exchanges code → authorization server redirects with code

Authorization server redirects with code → user authenticates → user consents → client exchanges code

Client exchanges code → user authenticates → user consents → authorization server redirects with token

A developer is implementing the OAuth2 authorization code grant flow. They want to protect against cross-site request forgery (CSRF) attacks, where an attacker tricks a user's browser into making a request to the client's callback endpoint. What is the recommended way to mitigate this?

Validate the 'scope' parameter in the callback

Include a random 'state' parameter in the authorization request and validate it in the callback

Include the client_secret in the authorization request

CiscoCertified DevNet Professional

Domain 2Objective 5

Describe the Steps in the OAuth2 Three-Legged Authorization Code Grant Flow 350-901 Practice Questions (Page 2)

Part of the 2.0 Using APIs domain, which accounts for 20% of the 350-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

20%of the exam

10 Concepts in This Objective

OAuth2 roles
Authorization code grant flow steps
Authorization request parameters
User authentication and consent
Authorization code issuance
Token exchange request
Access token and refresh token response
State parameter and CSRF protection
Redirect URI validation
Refresh token usage

Questions 6–10

6application · medium
A user has authorized a third-party application to access their calendar. The access token expires after one hour. The application needs to continue accessing the calendar for several days without requiring the user to re-authenticate. What should the application do?
Select an answer first
7application · medium
A user clicks 'Sign in with Google' on a third-party website. The website redirects the user to Google's login page. The user enters their Google credentials and sees a consent screen asking if they want to allow the website to view their profile. After clicking 'Allow', the user is redirected back to the website with an authorization code. In this scenario, which entity is the resource owner?
Select an answer first
8foundation · easy
In the authorization code grant flow, what is the correct sequence after the client redirects the resource owner to the authorization server?
Select an answer first
9application · medium
A developer is implementing the OAuth2 authorization code grant flow. They want to protect against cross-site request forgery (CSRF) attacks, where an attacker tricks a user's browser into making a request to the client's callback endpoint. What is the recommended way to mitigate this?
Select an answer first
10foundation · easy
Which field in the token response indicates how long the access token remains valid?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-901” is a trademark of its owner, used for identification only.

Describe the Steps in the OAuth2 Three-Legged Authorization Code Grant Flow 350-901 Practice Questions (Page 2)

Questions 6–10

A user has authorized a third-party application to access their calendar. The access token expires after one hour. The application needs to continue accessing the calendar for several days without requiring the user to re-authenticate. What should the application do?

In the authorization code grant flow, what is the correct sequence after the client redirects the resource owner to the authorization server?

A developer is implementing the OAuth2 authorization code grant flow. They want to protect against cross-site request forgery (CSRF) attacks, where an attacker tricks a user's browser into making a request to the client's callback endpoint. What is the recommended way to mitigate this?

Which field in the token response indicates how long the access token remains valid?

Keep studying — 2.0 Using APIs