Mobile Authentication and Credential Security

Auto audio on: the next questions will be read aloud when you click Continue.

1. 1

   What is the primary security purpose of PKCE in a mobile OAuth authorization-code flow?

   A To encrypt every API response with the user's password B To prevent an intercepted authorization code from being redeemed by another app C To let a mobile app safely embed a permanent client secret
2. 2

   Where should a mobile app generally store a long-lived refresh token?

   A In the operating system's protected credential storage, such as Keychain or Keystore B In an unencrypted preferences file for quick access C Inside the application package as a compiled constant
3. 3

   The illustrated TLS chain is missing the intermediate certificate. What is a likely result when the app validates the server?

   

   A The leaf certificate automatically becomes a trusted root B The connection remains valid because intermediates are never required C Chain construction may fail unless the client can obtain the missing intermediate
4. 4

   In the depicted PKCE flow, what must the mobile app create before opening the authorization page?

   

   A A random code verifier and its derived code challenge B A permanent client secret shared in the app binary C A refresh token selected by the user
5. 5

   What does biometric authentication usually prove when it unlocks a token stored on a device?

   A That every request originated from an uncompromised operating system B That an enrolled local user satisfied the device's biometric policy C That the biometric sample was sent to and verified by the API server
6. 6

   The image compares a custom-scheme callback with a verified HTTPS callback. What is the main security benefit of the verified HTTPS approach?

   

   A It removes the need for authorization-code expiration B It allows every installed app to receive the same callback C It uses domain-to-app association to reduce callback hijacking
7. 7

   Which validation set is the most appropriate before an API trusts a JWT access token?

   A Decode the payload and confirm that it contains a user name B Check only the expiration claim because HTTPS already verifies the token C Verify the signature and approved algorithm, then validate issuer, audience, and expiration
8. 8

   The log excerpt includes an Authorization header. How should production logging handle this field?

   

   A Record it in full so authentication failures can always be replayed B Remove or redact the credential before the event is stored C Convert the header to uppercase before recording it
9. 9

   What is the main purpose of a nonce in an OpenID Connect authentication request?

   A To bind the authentication request to the ID token and help detect replay B To replace TLS encryption between the app and identity provider C To define how many times an access token may call an API
10. 10

    Why does the illustrated pinning configuration retain a backup public-key pin?

    

    A To let the app use the API without a network connection B To make an expired certificate valid indefinitely C To support planned key rotation without locking updated servers out of the app
11. 11

    What should an app and its authorization server do when a user explicitly signs out?

    A Delete only the visible profile name while retaining all tokens B Clear local credentials and revoke or invalidate refresh capability when supported C Publish the access token to a logout endpoint as a URL query parameter
12. 12

    In the envelope-encryption diagram, what is the role of the key-encryption key?

    

    A It wraps the data-encryption key so the protected data need not be re-encrypted during every master-key change B It is sent as plaintext with each API request to identify the user C It replaces the random data-encryption key with the user's password
13. 13

    Which assumption is safest when designing authentication for devices that may be rooted, jailbroken, or instrumented?

    A Obfuscation makes embedded API secrets permanently inaccessible B Root detection guarantees that all modified devices will be blocked C The client can be inspected or altered, so privileged server secrets must remain server-side
14. 14

    The chart shows many failed sign-ins across numerous accounts from changing network addresses. Which defense best targets this credential-stuffing pattern?

    

    A Disable token expiration for users who previously signed in B Apply adaptive rate limits and risk controls across accounts, devices, and network signals C Store submitted passwords in application analytics for comparison
15. 15

    Why is an external user-agent, such as the system browser, generally recommended for mobile OAuth authorization?

    A It supports shared sign-in sessions and lets users verify the identity provider's domain B It allows the app to read and store the user's identity-provider password C It removes the need to validate redirect URIs
16. 16

    A QR-scanning app requests camera, contacts, and continuous location access on first launch. Which security principle is most directly violated?

    

    A Certificate transparency B Forward secrecy C Least privilege
17. 17

    How should a backend use a mobile device-attestation result?

    A As permanent proof that every future request from the device is legitimate B As one risk signal combined with authentication, authorization, freshness, and server-side monitoring C As a replacement for validating access-token signatures
18. 18

    What security benefit does refresh-token rotation with reuse detection provide?

    A Reusing an older token can reveal theft and trigger invalidation of the token family B A refresh token can be safely placed in public application logs C Access tokens no longer need an expiration time