OAuth 2.0 and OpenID Connect for Backend Developers

Auto audio on: the next questions will be read aloud when you click Continue.

1. 1

   What is the primary purpose of OAuth 2.0?

   A To define how user passwords are encrypted in a database B To grant limited access to protected resources without sharing the user's credentials C To synchronize user accounts between relational databases
2. 2

   In the illustrated OAuth architecture, which component validates the access token before returning the requested data?

   

   A The resource server B The user agent C The client application
3. 3

   What does OpenID Connect add on top of OAuth 2.0?

   A A database transaction protocol B A replacement for HTTPS C An identity layer for authenticating users
4. 4

   In the authorization code flow with PKCE shown, which value does the client send to the token endpoint to prove it initiated the request?

   

   A The resource owner's password B The code verifier C The resource server's private key
5. 5

   Which token should a backend API normally accept as proof that a client is authorized to call it?

   A An access token B An ID token C An authorization code
6. 6

   When validating a JWT access token, which combination of checks is essential?

   

   A Check only that the token contains a subject claim B Decode the payload and trust it if the JSON is valid C Verify its signature, issuer, audience, and expiration
7. 7

   What security threat is the OAuth state parameter primarily intended to mitigate?

   A SQL injection in the resource server B Cross-site request forgery and unsolicited authorization responses C Brute-force attacks against password hashes
8. 8

   What is the purpose of the nonce parameter in an OpenID Connect authentication request?

   A To bind an ID token to the authentication request and help prevent replay B To define which API operations an access token permits C To extend the lifetime of a refresh token
9. 9

   Which OAuth 2.0 grant is most appropriate for the illustrated service-to-service request with no end user involved?

   

   A Authorization code grant B Device authorization grant C Client credentials grant
10. 10

    Why should an authorization server require an exact redirect URI match for a registered client?

    A To ensure every access token is formatted as a JWT B To prevent authorization responses from being sent to attacker-controlled locations C To allow the client to omit PKCE from all requests
11. 11

    What is the best practice when defining scopes for an application that only needs to read customer profiles?

    A Request a narrowly defined profile read scope B Request every available scope in case it is needed later C Replace scopes with a long-lived administrator token
12. 12

    In the illustrated refresh-token rotation sequence, what should the authorization server do if an already-used refresh token is presented again?

    

    A Issue another token because the original refresh token remains valid indefinitely B Convert the old refresh token into an ID token C Treat it as possible token reuse and revoke or invalidate the affected token family
13. 13

    When an API receives an opaque access token, how can it obtain the token's active status and authorization metadata from the issuer?

    A By decoding the token as an unsigned JWT B By calling the authorization server's token introspection endpoint C By exchanging the token at the client's redirect URI