AZ-204 Implement Azure security Practice Question
You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to call a downstream API on behalf of the signed-in user. Which OAuth 2.0 flow should you implement?
⚠ Common exam trap
A common mix-up: candidates confuse the client credentials flow (Option A) with the need to call a downstream API, but they forget that the client credentials flow does not act on behalf of a user, only the application itself, which fails the 'on behalf of the signed-in user' requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization code flow with PKCE
The authorization code flow with PKCE is the correct choice because the app needs to authenticate a signed-in user and then call a downstream API on their behalf. This flow securely exchanges an authorization code for an access token, and PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks, which is essential for public clients like web apps. It is the recommended OAuth 2.0 flow for single-page apps and native apps, but also applicable to web apps that require high security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Client credentials flow
Why it's wrong here
The Client Credentials flow is designed for server-to-server communication where an application needs to access resources on its own behalf, without a user context. It uses the application's client ID and client secret to obtain an access token directly from the authorization server. This flow is unsuitable for a web app authenticating users because it does not involve user interaction or consent, thus failing to establish a user's identity within the application.
- ✗
Implicit flow
Why it's wrong here
The Implicit flow, while historically used by single-page applications (SPAs), is now deprecated due to inherent security risks, primarily the lack of refresh tokens and the exposure of access tokens in the browser's URL fragment. It directly returns an access token to the client without a backend exchange, making it vulnerable to token leakage and replay attacks. Modern web apps requiring user authentication and API calls should avoid this flow in favor of more secure alternatives.
- ✓
Authorization code flow with PKCE
Why this is correct
The Authorization Code flow with PKCE (Proof Key for Code Exchange) is the recommended and most secure OAuth 2.0 flow for web applications, including single-page applications and traditional web apps. It involves exchanging an authorization code for an access token at the backend, preventing the token from being exposed in the browser. PKCE further enhances security by mitigating authorization code interception attacks, ensuring that only the legitimate client application can exchange the code for tokens, making it ideal for user-authenticated API calls.
- ✗
Device code flow
Why it's wrong here
The Device Code flow is specifically designed for input-constrained devices, such as smart TVs, IoT devices, or command-line applications, where direct user interaction for authentication is difficult or impossible. It requires the user to visit a separate browser on another device to enter a short code displayed on the constrained device. This flow is entirely inappropriate for a typical web app, which has full browser capabilities for direct user interaction and redirection-based authentication.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.