Describe the Steps in the OAuth2 Three-Legged Authorization Code Grant Flow 350-901 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In the token exchange request, which parameter tells the authorization server which grant flow is being completed?

   • Aredirect_uri
   • Bclient_secret
   • Cgrant_type
   • Dcode
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What happens if the redirect_uri in the authorization request does not match the registered redirect_uri for the client?

   • AThe authorization server proceeds but includes a warning in the response
   • BThe authorization server sends the code to the client_id's default callback
   • CThe authorization server redirects to the registered URI anyway
   • DThe authorization server rejects the request and displays an error to the user
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security analyst is reviewing an OAuth2 implementation and notices that the client does not validate the state parameter in the callback. The analyst warns that this could lead to a CSRF attack. What is the most likely impact of this vulnerability?

   • AAn attacker could intercept the authorization code in transit
   • BAn attacker could trick the user's browser into making a callback that the client processes as a legitimate authorization response
   • CAn attacker could modify the scope parameter in the authorization request
   • DAn attacker could steal the user's authorization code and exchange it for an access token
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A client application successfully exchanges an authorization code for a token. The response from the token endpoint includes the following fields: access_token, token_type, expires_in, and refresh_token. What does the token_type field indicate?

   • AThe expiration time of the refresh token
   • BThe format of the access token (e.g., Bearer)
   • CThe cryptographic algorithm used to sign the token
   • DThe type of authorization grant used (e.g., authorization_code)
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A developer is designing a system where a mobile app (client) needs to access a user's photos stored on a cloud service. The cloud service acts as both the authorization server and the resource server. The user authenticates and consents to the app accessing their photos. Which entity is the resource server in this scenario?

   • AThe mobile app
   • BThe authorization server's token endpoint
   • CThe cloud service's photo storage API
   • DThe user
   Reveal Solution Discussion Select an answer first