How does a confidential client typically authenticate itself during the token exchange request?

By sending its client_id and client_secret in the request body or using HTTP Basic auth

By presenting the authorization code as proof of identity

By including a valid access token in the request

By including the resource owner's username and password

What is the primary purpose of the authorization code being short-lived and exchanged for a token?

To ensure the code is only exposed briefly in the browser URL, reducing interception risk

To allow the authorization server to revoke the code if the user changes their mind

To force the client to authenticate the user again before exchanging

To allow the client to use the code multiple times for different tokens

Why does the authorization server validate the redirect_uri during the authorization request?

To check if the user has previously consented to this client

To ensure the client is a registered and trusted application

To determine which scopes the client is allowed to request

To prevent the authorization code from being delivered to an attacker-controlled URL

What is the primary advantage of using a refresh token to obtain a new access token?

It allows the client to bypass the authorization server entirely

It allows the client to access resources on behalf of any user

It provides a longer-lived access token than the original

It eliminates the need for the resource owner to re-authenticate and re-consent

CiscoCertified DevNet Professional

Domain 2Objective 5

Describe the Steps in the OAuth2 Three-Legged Authorization Code Grant Flow 350-901 Practice Questions (Page 4)

Part of the 2.0 Using APIs domain, which accounts for 20% of the 350-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

20%of the exam

10 Concepts in This Objective

OAuth2 roles
Authorization code grant flow steps
Authorization request parameters
User authentication and consent
Authorization code issuance
Token exchange request
Access token and refresh token response
State parameter and CSRF protection
Redirect URI validation
Refresh token usage

Questions 16–20

16foundation · easy
How does a confidential client typically authenticate itself during the token exchange request?
Select an answer first
17foundation · easy
What is the primary purpose of the authorization code being short-lived and exchanged for a token?
Select an answer first
18foundation · easy
Why does the authorization server validate the redirect_uri during the authorization request?
Select an answer first
19application · medium
A developer is constructing the authorization request URL for a web application. The request must include the response_type, client_id, redirect_uri, scope, and state. Which value should be used for the response_type parameter?
Select an answer first
20foundation · easy
What is the primary advantage of using a refresh token to obtain a new access token?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-901” is a trademark of its owner, used for identification only.