AZ-204 Implement Azure security Practice Question
You need to secure a web API that is called from a single-page application (SPA). The API uses Microsoft Entra ID for authentication. Which OAuth 2.0 flow should the SPA use?
⚠ Common exam trap
Test-takers frequently choose the Implicit flow (Option D) because it was historically the standard for SPAs, but Microsoft Entra ID and OAuth 2.0 BCP now deprecate it in favor of the authorization code flow with PKCE, which is the only secure option for public clients.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization code flow with PKCE
The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications because it provides a secure way to obtain an access token without exposing the client secret, which cannot be stored confidentially in a browser. PKCE adds a cryptographic challenge to prevent authorization code interception attacks, making it the only flow that meets modern security standards for public clients like SPAs calling Microsoft Entra ID-protected APIs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authorization code flow with PKCE
Why this is correct
The Authorization Code flow with PKCE (Proof Key for Code Exchange) is the recommended and most secure method for Single-Page Applications (SPAs) because it eliminates the need for a client secret, which SPAs cannot securely store. It involves a two-step process where the SPA first obtains an authorization code, then exchanges it for tokens at the identity provider's token endpoint. PKCE adds a dynamic secret (code verifier/challenge) to this exchange, preventing code interception attacks by ensuring only the original client can redeem the authorization code.
- ✗
Resource owner password credentials flow
Why it's wrong here
The Resource Owner Password Credentials (ROPC) flow directly collects the user's username and password within the client application and sends them to the identity provider. This flow is highly discouraged and considered an anti-pattern for SPAs due to significant security risks, as it exposes user credentials to the client and bypasses the identity provider's interactive authentication and consent mechanisms. It should only be used in highly trusted, first-party applications under very specific, controlled circumstances.
- ✗
Client credentials flow
Why it's wrong here
The Client Credentials flow is designed exclusively for machine-to-machine communication, where a confidential client (like a daemon service or backend application) needs to access resources without a user context. It authenticates the application itself using its client ID and client secret, not an end-user. Therefore, it is entirely unsuitable for a Single-Page Application (SPA) which acts on behalf of an authenticated user and requires user interaction for authentication.
- ✗
Implicit flow
Why it's wrong here
The Implicit flow, now largely deprecated, directly returns access tokens and ID tokens in the URL fragment of the redirect URI after user authentication. This method is less secure than Authorization Code with PKCE because tokens can be exposed in browser history, referrer headers, and are vulnerable to interception. Furthermore, it typically does not support refresh tokens, requiring re-authentication more frequently and lacking robust token management capabilities.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.