A developer is implementing a client that needs to maintain access to a user's resources for a long period. The token response includes an access_token with expires_in=3600 and a refresh_token. The developer wants to ensure the client can continue accessing resources without user interaction. What is the correct approach?

Store the refresh token securely and use it to request a new access token when the current one expires

Request a new authorization code every time the access token expires

Use the refresh token as an access token in API calls

Use the access token until it expires, then ask the user to re-authenticate

A user is authenticating with an OAuth2 authorization server. After entering their username and password, they are shown a screen that lists the permissions the client is requesting, such as 'View your profile' and 'Read your email'. What is this screen called, and what is its purpose?

The resource server, which validates the access token

The token endpoint, which issues the access token

The client's login page, which collects the user's credentials

The consent screen, which allows the user to approve or deny the client's requested permissions

CiscoCertified DevNet Professional

Domain 2Objective 5

Describe the Steps in the OAuth2 Three-Legged Authorization Code Grant Flow 350-901 Practice Questions (Page 5)

Part of the 2.0 Using APIs domain, which accounts for 20% of the 350-901 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

10concepts

20%of the exam

10 Concepts in This Objective

OAuth2 roles
Authorization code grant flow steps
Authorization request parameters
User authentication and consent
Authorization code issuance
Token exchange request
Access token and refresh token response
State parameter and CSRF protection
Redirect URI validation
Refresh token usage

Questions 21–25

21foundation · easy
Which OAuth2 authorization request parameter is used to maintain state between the client's request and the callback, helping prevent CSRF?
Select an answer first
22foundation · easy
In an OAuth2 authorization request, which parameter specifies the type of grant being requested?
Select an answer first
23foundation · easy
In the OAuth2 authorization code grant, which role does the application that requests access to a user's data on their behalf play?
Select an answer first
24expert · medium
A developer is implementing a client that needs to maintain access to a user's resources for a long period. The token response includes an access_token with expires_in=3600 and a refresh_token. The developer wants to ensure the client can continue accessing resources without user interaction. What is the correct approach?
Select an answer first
25application · medium
A user is authenticating with an OAuth2 authorization server. After entering their username and password, they are shown a screen that lists the permissions the client is requesting, such as 'View your profile' and 'Read your email'. What is this screen called, and what is its purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-901

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-901” is a trademark of its owner, used for identification only.

Describe the Steps in the OAuth2 Three-Legged Authorization Code Grant Flow 350-901 Practice Questions (Page 5)

Questions 21–25

Which OAuth2 authorization request parameter is used to maintain state between the client's request and the callback, helping prevent CSRF?

In an OAuth2 authorization request, which parameter specifies the type of grant being requested?

In the OAuth2 authorization code grant, which role does the application that requests access to a user's data on their behalf play?

A user is authenticating with an OAuth2 authorization server. After entering their username and password, they are shown a screen that lists the permissions the client is requesting, such as 'View your profile' and 'Read your email'. What is this screen called, and what is its purpose?

Keep studying — 2.0 Using APIs