AZ-204 Practice Question: Connect to and consume Azure services and third-party services

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Client credentials flow

  Why it's wrong here

  The Client Credentials flow is designed for an application to authenticate itself directly with the identity provider, using its own client ID and client secret, without any user interaction. This flow is suitable for server-to-server communication, daemon applications, or background services that need to access resources on their own behalf. It is fundamentally inappropriate for authenticating an interactive user within a web application, as it does not involve or represent a user's identity.

• ✓

  Authorization code flow with PKCE

  Why this is correct

  The Authorization Code flow with PKCE (Proof Key for Code Exchange) is the recommended and most secure method for authenticating users in public clients like single-page applications (SPAs) and mobile apps. This flow prevents code interception attacks by requiring the client to generate a secret `code_verifier` and a `code_challenge` that are exchanged during the authorization and token request steps, respectively. This ensures that only the legitimate client that initiated the authorization request can successfully exchange the authorization code for access and refresh tokens, providing robust security without exposing client secrets.

• ✗

  Implicit flow

  Why it's wrong here

  The Implicit flow directly returns access tokens in the URL fragment after user authentication, bypassing the authorization code exchange step. While historically used for browser-based applications, it is now deprecated due to significant security vulnerabilities, including token leakage through browser history, referrer headers, and potential for cross-site scripting (XSS) attacks. Its design also typically precludes the use of refresh tokens, limiting its utility for maintaining long-lived user sessions securely.

• ✗

  Resource owner password credentials flow

  Why it's wrong here

  The Resource Owner Password Credentials (ROPC) flow involves the client directly collecting the user's username and password and sending them to the identity provider. This flow is highly discouraged and considered an anti-pattern because it exposes user credentials to the client application, significantly increasing the risk of phishing, credential theft, and reducing the user's control over their identity. It should only be considered in very specific, highly trusted first-party scenarios where other, more secure flows are not technically feasible.

Go deeper

Related to this question