MCSD Authentication, Authorization & Identity 1 — Questions and Answers
Question 1: Which OAuth 2.0 grant type is recommended for a single-page application (SPA) that needs to obtain an access token without a backend server?
- Client Credentials Flow
- Authorization Code Flow with PKCE (Correct answer)
- Resource Owner Password Credentials Flow
- Implicit Flow
Correct answer: Authorization Code Flow with PKCE
Authorization Code Flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for SPAs because it prevents authorization code interception attacks without requiring a client secret.
Question 2: A JSON Web Token (JWT) is composed of three Base64URL-encoded parts. Which part contains the claims about the user or entity?
- Header
- Payload (Correct answer)
- Signature
- Footer
Correct answer: Payload
The Payload is the second part of a JWT and contains the claims, which are statements about the entity (typically the user) and additional metadata.
Question 3: When registering an application in Azure Active Directory, what is the primary purpose of setting a Redirect URI?
- To specify the resource server the app will call
- To define where Azure AD sends the authorization response after authentication (Correct answer)
- To configure the app's logout endpoint
- To set the app's homepage URL for users
Correct answer: To define where Azure AD sends the authorization response after authentication
The Redirect URI (also called reply URL) is the location where Azure AD sends the authentication response including tokens or authorization codes after successful authentication.
Question 4: In claims-based identity, what is a 'claim'?
- A cryptographic certificate used to verify identity
- A statement made by an identity provider about a subject, such as name or role (Correct answer)
- A permission granted to an application to access a resource
- An encrypted token used to maintain session state
Correct answer: A statement made by an identity provider about a subject, such as name or role
A claim is a key-value statement made by a trusted identity provider (issuer) about a subject, such as the user's name, email, roles, or other attributes.
Question 5: What is the key difference between OpenID Connect (OIDC) and OAuth 2.0?
- OAuth 2.0 is for authentication while OIDC is for authorization
- OIDC adds an identity layer on top of OAuth 2.0 enabling authentication (Correct answer)
- OIDC uses symmetric encryption while OAuth 2.0 uses asymmetric encryption
- OAuth 2.0 requires user consent while OIDC does not
Correct answer: OIDC adds an identity layer on top of OAuth 2.0 enabling authentication
OpenID Connect is an identity layer built on top of OAuth 2.0 that adds authentication capabilities, introducing the ID token to convey user identity information alongside OAuth's access tokens.
Question 6: Which Microsoft Authentication Library (MSAL) method should be called first to silently acquire a token before falling back to interactive authentication?
- acquireTokenPopup()
- acquireTokenSilent() (Correct answer)
- loginRedirect()
- acquireTokenByCode()
Correct answer: acquireTokenSilent()
acquireTokenSilent() should always be attempted first as it retrieves tokens from the cache without user interaction; interactive methods like acquireTokenPopup() are only used as a fallback when silent acquisition fails.
Question 7: What is the purpose of a refresh token in OAuth 2.0?
- To encrypt the access token before transmission
- To obtain a new access token after the current one expires without re-authenticating the user (Correct answer)
- To verify the identity of the resource server
- To invalidate all existing access tokens for a user
Correct answer: To obtain a new access token after the current one expires without re-authenticating the user
A refresh token is a long-lived credential used to obtain new access tokens after they expire, allowing the application to maintain access without requiring the user to log in again.
MCSD Authentication, Authorization & Identity 1
Which OAuth 2.0 grant type is recommended for a single-page application (SPA) that needs to obtain an access token without a backend server?