Describe the Steps in the OAuth2 Three-Legged Authorization Code Grant Flow 350-901 Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A developer is implementing the OAuth2 authorization code grant flow for a web application. The user has just clicked 'Login' and the application has redirected the user's browser to the authorization server. What is the next step in the flow?

   • AThe authorization server sends an access token directly to the client
   • BThe resource server validates the client's credentials
   • CThe authorization server authenticates the user and asks for consent
   • DThe client sends the authorization code to the token endpoint
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What security issue does the state parameter in the OAuth2 authorization request primarily mitigate?

   • AToken theft via man-in-the-middle attacks
   • BBrute-force attacks on the authorization code
   • CSession fixation attacks
   • DCross-site request forgery (CSRF)
   Reveal Solution Discussion Select an answer first