OKTA Industry Best Practices 3

Question 1

When integrating a modern web application for user sign-in, which protocol is generally recommended for authentication on top of OAuth 2.0?

Accepted Answer

OpenID Connect

Answer

OpenID Connect adds an identity layer (ID tokens) to OAuth 2.0 for authenticating users in modern apps.

Question 2

Which OAuth 2.0 flow is the current best practice for single-page and native applications?

Accepted Answer

Authorization Code flow with PKCE

Answer

Authorization Code with PKCE protects public clients against code interception and replaces the deprecated implicit flow.

Question 3

Which OAuth 2.0 grant is appropriate for service-to-service communication with no user present?

Accepted Answer

Client Credentials

Answer

The Client Credentials grant lets a machine client authenticate with its own credentials to obtain an access token.

Question 4

What is a recommended practice for handling access token lifetimes?

Accepted Answer

Use short-lived access tokens with refresh tokens, ideally with rotation

Answer

Short-lived access tokens limit exposure if stolen, while rotating refresh tokens maintain usability securely.

Question 5

In SAML, what best practice helps prevent assertion tampering?

Accepted Answer

Digitally signing assertions and validating the signature at the service provider

Answer

Signed assertions let the SP verify integrity and that the assertion was issued by the trusted IdP.

OKTA - OKTA Certified Professional Practice Test