MCSD Authentication, Authorization & Identity 3

Question 1

When building a multi-tenant Azure AD application, what does the 'common' endpoint (login.microsoftonline.com/common) allow?

Accepted Answer

Authentication for users from any Azure AD tenant or personal Microsoft accounts

Answer

The 'common' endpoint is a tenant-independent endpoint that allows users from any Azure AD tenant or personal Microsoft accounts to authenticate, making it the correct endpoint for multi-tenant applications.

Question 2

The OAuth 2.0 On-Behalf-Of (OBO) flow is used in which scenario?

Accepted Answer

A middle-tier API calls a downstream API on behalf of the user who called the middle-tier API

Answer

The On-Behalf-Of flow allows a middle-tier service (like a Web API) to propagate the delegated user identity and permissions to a downstream service by exchanging the incoming access token for a new token scoped to the downstream API.

Question 3

In Azure AD, what is the primary difference between using 'App Roles' versus 'Azure AD Security Groups' for authorization in a custom application?

Accepted Answer

App Roles are included in the token automatically; Groups require a separate Graph API call for large memberships

Answer

App Roles are always included in the token claims automatically, whereas group membership claims may be omitted from tokens when a user belongs to more than 150-200 groups (depending on token type), requiring a Graph API call to retrieve all group memberships.

Question 4

When validating a JWT access token in a .NET Web API, which claim should be verified to ensure the token was intended for your specific API?

Accepted Answer

aud (audience) claim

Answer

The 'aud' (audience) claim identifies the intended recipient of the token; a Web API must verify that its own identifier (Application ID URI) matches the aud claim to prevent token misuse across different APIs.

Question 5

What does PKCE (Proof Key for Code Exchange) add to the Authorization Code Flow, and why is it important?

Accepted Answer

It creates a cryptographic binding between the authorization request and the token request to prevent code interception attacks

Answer

PKCE adds a code_verifier and code_challenge pair where the challenge is sent with the auth request and the verifier is sent with the token request, ensuring only the original requester can exchange the authorization code even if it is intercepted.

MCSD - Microsoft Certified Solutions Developer Practice Test

MCSD - Microsoft Certified Solutions Developer Practice Test

MCSD Authentication, Authorization & Identity 3