SC-100 Practice Question: Design security solutions for applications and data
Your organization uses Microsoft Entra ID and plans to implement a custom line-of-business application that accesses Microsoft Graph APIs. The application will be used by employees and external partners. You need to ensure that the application can authenticate users and obtain appropriate permissions without exposing the client secret. What should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement OAuth 2.0 authorization code flow with PKCE.
The application is a line-of-business app used by employees and external partners, which implies it may be a public client (e.g., mobile or desktop) that cannot securely store a client secret. OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended authentication pattern for such clients because it eliminates the need for a client secret by using a dynamically generated code verifier. This ensures the client secret is never exposed. Option B is correct. Option A (system-assigned managed identity) is only suitable for Azure-hosted services, not client applications. Option C (storing client secret in Key Vault) still requires secret retrieval at runtime, which can be insecure for public clients. Option D (implicit grant flow) is outdated and less secure than authorization code flow with PKCE.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a system-assigned managed identity to authenticate to Microsoft Graph.
Why it's wrong here
A system-assigned managed identity is inherently tied to an Azure resource such as a virtual machine or App Service, and its purpose is to authenticate that resource to Microsoft Entra ID without storing credentials. It cannot be used for a client application that runs on a user's device or in a browser, nor does it support delegated user sign-in scenarios. Since the requirement is for an application to authenticate to Microsoft Graph on behalf of a user, a managed identity is not applicable.
- ✓
Implement OAuth 2.0 authorization code flow with PKCE.
Why this is correct
The OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended approach for native, mobile, and single-page applications that need to call Microsoft Graph. It first obtains an authorization code, which is then exchanged for tokens, and PKCE adds a cryptographically random code verifier that prevents authorization code interception or replay attacks. This flow eliminates the need for a client secret, making it secure for public clients while providing full support for refresh tokens and user consent.
- ✗
Store the client secret in Azure Key Vault and retrieve it at runtime.
Why it's wrong here
Storing the client secret in Azure Key Vault ensures the secret is protected at rest, but the application must still authenticate to Key Vault and retrieve that secret at runtime, which introduces additional dependencies and a static credential that can be compromised. For any public client (such as a desktop or mobile app), a secret is inherently vulnerable to extraction from the device, regardless of where it is stored in the cloud. The correct approach is to avoid a client secret altogether by using the authorization code flow with PKCE, which provides equivalent security without the secret-management overhead.
- ✗
Register the application as a public client and use the implicit grant flow.
Why it's wrong here
The implicit grant flow, which returns access tokens directly in the URL fragment, is deprecated by the OAuth 2.0 specification and the Microsoft identity platform due to serious security risks. Tokens can leak through browser history, referrer headers, or malicious JavaScript, and the flow does not support refresh tokens, forcing repeated user interaction. While registering the application as a public client is acceptable, the implicit grant should never be used for new development; the authorization code flow with PKCE is the secure, recommended alternative.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.