AZ-204 Implement Azure security Practice Question
A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The architecture review board prefers a managed Azure-native control.
⚠ Common exam trap
Many candidates confuse the implicit flow (which was historically used for SPAs) with the modern PKCE-enhanced authorization code flow, not realizing that the implicit flow is now deprecated and the authorization code flow with PKCE is the current best practice for public clients.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization code flow with PKCE
The authorization code flow with PKCE (Proof Key for Code Exchange) is the correct choice because it is designed for public clients (like single-page apps) that cannot securely store a client secret. PKCE uses a dynamically generated cryptographic code verifier and challenge to prevent authorization code interception attacks, making it the recommended OAuth 2.0 flow for SPAs calling protected APIs in Microsoft Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implicit flow
Why it's wrong here
The implicit flow returns tokens directly in the browser redirect without a code exchange, and Microsoft Entra ID no longer recommends it for SPAs. It is tempting because SPAs historically used it, but the authorisation code flow with PKCE is the managed Azure-native replacement.
- ✗
Client credentials flow
Why it's wrong here
Client credentials grants app-only tokens using a secret or certificate, which a public SPA cannot securely hold, and it has no user sign-in. It is tempting for daemon or service-to-service calls, but the stem requires delegated user authentication, so authorisation code with PKCE applies.
- ✗
Resource owner password credentials flow
Why it's wrong here
The resource owner password credentials flow requires the app to handle the user's password directly, which conflicts with the no-secret constraint and Microsoft's guidance against it for single-page apps. It is tempting because it suits legacy or first-party clients that cannot redirect, but here authorisation code flow with PKCE is required.
- ✓
Authorization code flow with PKCE
Why this is correct
PKCE adds a dynamically generated code verifier and challenge, binding the authorization code to the client without a secret, which suits a public single-page app. The authorization code flow itself keeps tokens out of the browser front channel, satisfying the review board's preference for a managed Microsoft Entra ID-native control.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 883-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.