MCSD Authentication, Authorization & Identity

Question 1

Which OAuth 2.0 grant type is recommended for a single-page application (SPA) that needs to obtain an access token without a backend server?

Accepted Answer

Authorization Code Flow with PKCE

Answer

Client Credentials Flow

Answer

Resource Owner Password Credentials Flow

Answer

Implicit Flow

Question 2

A JSON Web Token (JWT) is composed of three Base64URL-encoded parts. Which part contains the claims about the user or entity?

Accepted Answer

Payload

Answer

Header

Answer

Signature

Answer

Footer

Question 3

When registering an application in Azure Active Directory, what is the primary purpose of setting a Redirect URI?

Accepted Answer

To define where Azure AD sends the authorization response after authentication

Answer

To specify the resource server the app will call

Answer

To configure the app's logout endpoint

Answer

To set the app's homepage URL for users

Question 4

In claims-based identity, what is a 'claim'?

Accepted Answer

A statement made by an identity provider about a subject, such as name or role

Answer

A cryptographic certificate used to verify identity

Answer

A permission granted to an application to access a resource

Answer

An encrypted token used to maintain session state

Question 5

What is the key difference between OpenID Connect (OIDC) and OAuth 2.0?

Accepted Answer

OIDC adds an identity layer on top of OAuth 2.0 enabling authentication

Answer

OAuth 2.0 is for authentication while OIDC is for authorization

Answer

OIDC uses symmetric encryption while OAuth 2.0 uses asymmetric encryption

Answer

OAuth 2.0 requires user consent while OIDC does not

Question 6

Which Microsoft Authentication Library (MSAL) method should be called first to silently acquire a token before falling back to interactive authentication?

Accepted Answer

acquireTokenSilent()

Answer

acquireTokenPopup()

Answer

loginRedirect()

Answer

acquireTokenByCode()

Question 7

What is the purpose of a refresh token in OAuth 2.0?

Accepted Answer

To obtain a new access token after the current one expires without re-authenticating the user

Answer

To encrypt the access token before transmission

Answer

To verify the identity of the resource server

Answer

To invalidate all existing access tokens for a user