Test your understanding of OAuth 2.0 roles, grant types, token types, and OIDC extensions used in modern authentication systems.
0 / 18 completed
1 / 18
In OAuth 2.0, the entity that owns the resource and grants access permission is called the ___.
The Resource Owner is the entity (typically a user) who owns the protected resource and can grant access to it.
2 / 18
Which OAuth 2.0 grant type is recommended for server-side web applications and includes PKCE for public clients?
The Authorization Code grant is the most secure flow for interactive login. PKCE (Proof Key for Code Exchange) extends it for public clients like mobile apps.
3 / 18
In OIDC, the token that contains claims about the authenticated user's identity is the ___.
The ID token is a JWT issued by the OIDC provider containing identity claims (iss, sub, aud, exp, iat) about the authenticated user.
4 / 18
Which OAuth 2.0 grant type is used for machine-to-machine communication where no user is involved?
The Client Credentials grant is used when a service authenticates directly with the authorization server without user involvement — ideal for background jobs and microservices.
5 / 18
OIDC scopes that request access to user profile information include ___.
'openid' is mandatory for OIDC flows. 'profile' and 'email' are standard OIDC scopes that grant access to specific user claims via the UserInfo endpoint.
6 / 18
Reviewer: 'I noticed you're using the `authorizationCode` grant type. For public clients accessing our API, are you implementing PKCE? It's best practice to mitigate potential attacks against the client.'
Which of the following best explains the reviewer's concern?
The reviewer is highlighting the vulnerability of using the `authorizationCode` grant type with public clients without PKCE. PKCE (Proof Key for Code Exchange) adds an extra layer of security by ensuring that only the legitimate client can exchange the authorization code for an access token, mitigating potential attacks where a malicious actor intercepts the code. The incorrect options misunderstand either the function of the grant type or the purpose of PKCE.
7 / 18
"Sarah (DevOps) posted in #api-dev: 'We're seeing a high number of 'access denied' errors when users try to access the reporting dashboard. I suspect it might be related to OAuth scopes – are we requesting too much authorization?'
What does Sarah likely mean by 'OAuth scopes' in this context?
Sarah's question about 'OAuth scopes' refers to the granular permissions requested from the user during the authorization process. These scopes define precisely what data and functionality the client application is allowed to access. Incorrect options misinterpret scopes as user roles, URL parameters, or credential storage methods – all of which are distinct concepts within OAuth 2.0.
8 / 18
PR Description: 'Implemented the 'profile' scope to allow the frontend to display user information. This enhances the user experience by providing a more personalized view.'
What is a potential security risk associated with requesting the 'profile' scope?
While requesting the 'profile' scope is convenient, it grants the application broad access to potentially sensitive user information. OAuth scopes should be minimized to only include the absolutely necessary permissions. This increases the risk of a security breach if the application is compromised or malicious data is accessed. The other options represent misunderstandings of how scopes operate or potential vulnerabilities.
9 / 18
"Mark (Frontend): 'I'm working on integrating with the payment gateway using OAuth. I've set up a 'client_credentials' grant type to handle the token exchange.'
In this scenario, what is the primary purpose of using the 'client_credentials' grant type?
The 'client_credentials' grant type is specifically designed for machine-to-machine communication. It allows a service account (representing an application) to obtain an access token without involving any human interaction or requiring the user to consent. This is typical in scenarios like integrating with third-party APIs where a user isn't directly involved in the authentication process. The other options describe different grant types and their respective uses.
10 / 18
Reviewer: 'I noticed you're using the `authorizationCode` grant type. For public clients accessing our API, are you implementing PKCE? It's best practice to mitigate potential attacks against the client.'
Which of the following best explains the reviewer's concern?
The reviewer is highlighting the vulnerability of using the `authorizationCode` grant type with public clients without PKCE. PKCE (Proof Key for Code Exchange) adds an extra layer of security by ensuring that only the legitimate client can exchange the authorization code for an access token, mitigating potential attacks where a malicious actor intercepts the code. The incorrect options misunderstand either the function of the grant type or the purpose of PKCE.
11 / 18
"Sarah (DevOps) posted in #api-dev: 'We're seeing a high number of 'access denied' errors when users try to access the reporting dashboard. I suspect it might be related to OAuth scopes – are we requesting too much authorization?'
What does Sarah likely mean by 'OAuth scopes' in this context?
Sarah's question about 'OAuth scopes' refers to the granular permissions requested from the user during the authorization process. These scopes define precisely what data and functionality the client application is allowed to access. Incorrect options misinterpret scopes as user roles, URL parameters, or credential storage methods – all of which are distinct concepts within OAuth 2.0.
12 / 18
PR Description: 'Implemented the 'profile' scope to allow the frontend to display user information. This enhances the user experience by providing a more personalized view.'
What is a potential security risk associated with requesting the 'profile' scope?
While requesting the 'profile' scope is convenient, it grants the application broad access to potentially sensitive user information. OAuth scopes should be minimized to only include the absolutely necessary permissions. This increases the risk of a security breach if the application is compromised or malicious data is accessed. The other options represent misunderstandings of how scopes operate or potential vulnerabilities.
13 / 18
"Mark (Frontend): 'I'm working on integrating with the payment gateway using OAuth. I've set up a 'client_credentials' grant type to handle the token exchange.'
In this scenario, what is the primary purpose of using the 'client_credentials' grant type?
The 'client_credentials' grant type is specifically designed for machine-to-machine communication. It allows a service account (representing an application) to obtain an access token without involving any human interaction or requiring the user to consent. This is typical in scenarios like integrating with third-party APIs where a user isn't directly involved in the authentication process. The other options describe different grant types and their respective uses.
14 / 18
During a code review, Sarah mentions using the term 'scope' within the context of OAuth 2.0. Which of the following best describes what she means?
Option A: The overall system architecture.
Option B: The permissions granted to an application or user.
Option C: The technical documentation for a project.
Option D: The network configuration of the server.
Sarah is referring to OAuth 2.0 scopes, which define the specific permissions granted to an application. A scope limits what resources an application can access – it's a crucial security aspect. Incorrect options relate to broader system design or documentation rather than granular authorization.
15 / 18
// This code retrieves user profile data based on an OAuth token.
What is the primary purpose of using 'scopes' in this scenario?
Scopes are fundamental to OAuth 2.0's security model. They precisely control what an application can access from a user's account—this is defined by the scopes requested. Authentication and encryption are separate concerns.
16 / 18
"Mark (Frontend) posted in #api-dev: 'I'm implementing a new feature that needs to access user profile information. I've requested the 'profile' scope in my OAuth flow.' Considering best practices, what is the MOST important reason for requesting this specific scope?
Requesting the 'profile' scope explicitly grants the application permission to access profile data – this is precisely what the scope's purpose is for. The other options relate to different aspects of the feature or authentication.
17 / 18
'We need a grant type that allows our internal microservice to securely access user data without any direct user interaction.' Which OAuth 2.0 grant type is MOST appropriate for this scenario?
Option A: Authorization Code
Option B: Client Credentials
Option C: Refresh Token
Option D: Implicit Flow
The 'Client Credentials' grant type is designed for machine-to-machine communication where no user interaction is involved. Authorization Code grants require a user to authorize the application, and implicit flow has security vulnerabilities that make it unsuitable here.
18 / 18
// Accessing user's address book requires the 'contacts' scope.
What is a potential consequence of incorrectly configuring the OAuth client to request this scope?
If the application is granted 'contacts' scope without proper authorization or validation, it could lead to unauthorized access of sensitive user data. This violates security best practices and exposes the system to potential risks.
What will I practise in "OAuth 2.0 & OpenID Connect Vocabulary"?
Test your understanding of OAuth 2.0 roles, grant types, token types, and OIDC extensions used in modern authentication systems.
How many exercises are in this module?
This module has 18 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.