AZ-204 Implement Azure security Practice Question
A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The design must avoid adding custom operational scripts.
⚠ Common exam trap
It's easy for candidates to confuse the deprecated implicit flow with the modern authorization code flow with PKCE, mistakenly believing that SPAs must use the implicit flow because they cannot store a secret, but the correct answer is the PKCE-enhanced authorization code flow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization code flow with PKCE
The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications (SPAs) that cannot securely store a client secret. PKCE uses a dynamically generated cryptographic code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This flow is designed for public clients (like SPAs) and avoids the need for custom operational scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implicit flow
Why it's wrong here
The Implicit flow is considered legacy and less secure for Single Page Applications because it directly returns access tokens in the browser's URL fragment. This exposes tokens to browser history, referrer headers, and potential interception by malicious scripts, making them vulnerable to leakage. Furthermore, it typically does not support refresh tokens, limiting session longevity and requiring frequent re-authentication.
- ✗
Client credentials flow
Why it's wrong here
The Client Credentials flow is designed for server-to-server or daemon applications that need to access protected resources without a user context. It involves the application authenticating itself directly to the identity provider using its own client ID and secret to obtain an access token. This flow is entirely unsuitable for a Single Page Application that requires user sign-in, as it provides no mechanism for user interaction or delegation of user identity.
- ✗
Resource owner password credentials flow
Why it's wrong here
The Resource Owner Password Credentials (ROPC) flow is highly discouraged and generally incompatible with modern security practices. It requires the application to collect the user's username and password directly, then send these credentials to the identity provider to obtain tokens. This bypasses crucial security features like multi-factor authentication and conditional access policies, creating a severe risk of credential compromise and phishing attacks.
- ✓
Authorization code flow with PKCE
Why this is correct
The Authorization Code flow with Proof Key for Code Exchange (PKCE) is the recommended and most secure method for Single Page Applications. PKCE protects public clients, which cannot securely store a client secret, by using a dynamically generated 'code verifier' and 'code challenge' during the authorization process. This mechanism ensures that even if a malicious actor intercepts the authorization code, they cannot exchange it for tokens without the original client's unique verifier, preventing code interception attacks.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.