AZ-204 Practice Question: Connect to and consume Azure services and third-party services

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  OAuth 2.0 Client Credentials flow

  Why it's wrong here

  This OAuth 2.0 flow is designed for server-to-server communication where an application needs to access protected resources on its own behalf, without a user's direct interaction or context. It involves the client application authenticating itself using its client ID and secret to obtain an access token. Since the scenario describes a web app authenticating users and then using their identity, this flow is inappropriate as it operates without any user context or delegation of user permissions.

• ✗

  OAuth 2.0 Implicit flow

  Why it's wrong here

  The OAuth 2.0 Implicit flow was primarily used by single-page applications (SPAs) to directly receive an access token in the browser's URL fragment after user authentication. However, this flow is now considered less secure and deprecated for new applications due to the token's exposure in browser history and referrer headers, and its inability to issue refresh tokens. Modern security best practices recommend using the Authorization Code flow with PKCE for SPAs and web apps.

• ✓

  OAuth 2.0 On-Behalf-Of flow

  Why this is correct

  The OAuth 2.0 On-Behalf-Of (OBO) flow is precisely designed for multi-tier applications where a middle-tier service, such as a web app, needs to call a downstream API using the authenticated user's identity. The web app exchanges the initial access token (obtained during user authentication) for a new access token specifically scoped for the downstream API. This ensures that the downstream API receives a token representing the original user, allowing it to enforce user-specific permissions and maintain the user's context across service boundaries.

• ✗

  OAuth 2.0 Authorization Code flow

  Why it's wrong here

  The OAuth 2.0 Authorization Code flow is the most secure and recommended method for web applications to authenticate users and obtain an access token. It involves redirecting the user to an authorization server, which then redirects back to the client with an authorization code. The client exchanges this code for an access token and optionally a refresh token. While this flow successfully authenticates the user for the web app, it does not directly provide a mechanism for the web app to acquire a new token for a separate downstream API while propagating the user's identity in a multi-tier scenario; that specific task requires the On-Behalf-Of flow.

Go deeper

Related to this question