1. What is OAuth 2.0 ? Junior A. long-lived credential used to obtain new access tokens without re-authenticating the user B. JWT attack where the signature algorithm is set to none so an unsigned token is wrongly accepted C. OAuth mechanism limiting the specific permissions an access token grants to a resource D. authorization framework letting an app obtain delegated access to resources without sharing credentials
2. Which term means: "authorization framework letting an app obtain delegated access to resources without sharing credentials"? Junior A. Token introspection B. OAuth 2.0 C. Bearer token D. JWT
3. Which statement is correct? Junior A. OAuth 2.0 — JWT attack where the signature algorithm is set to none so an unsigned token is wrongly accepted B. OAuth 2.0 — deprecated OAuth flow returning tokens directly in the redirect URL, vulnerable to leakage C. OAuth 2.0 — accepting a token minted for a different audience, enabling cross-service token reuse D. OAuth 2.0 — authorization framework letting an app obtain delegated access to resources without sharing credentials
4. What is OpenID Connect (OIDC) ? Junior A. long-lived credential used to obtain new access tokens without re-authenticating the user B. authentication layer built on OAuth 2.0 that adds an ID token proving the user's identity C. statements in a token payload such as iss (issuer), sub (subject), aud (audience), and exp (expiry) D. JSON Web Token, a signed (and optionally encrypted) token with header, payload claims, and signature
5. Which term means: "authentication layer built on OAuth 2.0 that adds an ID token proving the user's identity"? Junior A. OpenID Connect (OIDC) B. Token revocation C. Token introspection D. ID token
6. Which statement is correct? Junior A. OpenID Connect (OIDC) — authentication layer built on OAuth 2.0 that adds an ID token proving the user's identity B. OpenID Connect (OIDC) — statements in a token payload such as iss (issuer), sub (subject), aud (audience), and exp (expiry) C. OpenID Connect (OIDC) — endpoint a resource server calls to check whether a token is active and its associated metadata D. OpenID Connect (OIDC) — OIDC token (a JWT) asserting the authenticated user's identity to the client application
7. What is JWT ? Junior A. long-lived credential used to obtain new access tokens without re-authenticating the user B. authorization framework letting an app obtain delegated access to resources without sharing credentials C. JSON Web Token, a signed (and optionally encrypted) token with header, payload claims, and signature D. JSON Web Encryption, a JWT variant whose payload is encrypted rather than merely signed
8. Which term means: "JSON Web Token, a signed (and optionally encrypted) token with header, payload claims, and signature"? Junior A. Refresh token B. JWT C. Refresh token rotation D. Token introspection
9. Which statement is correct? Junior A. JWT — authorization framework letting an app obtain delegated access to resources without sharing credentials B. JWT — Proof Key for Code Exchange, an extension protecting the authorization code flow against interception, required for public clients C. JWT — JSON Web Token, a signed (and optionally encrypted) token with header, payload claims, and signature D. JWT — opaque value tying an OAuth authorization request to its callback to prevent CSRF
10. What is Access token ? Junior A. JWT attack where the signature algorithm is set to none so an unsigned token is wrongly accepted B. Proof Key for Code Exchange, an extension protecting the authorization code flow against interception, required for public clients C. invalidating a token before its expiry, typically via a revocation endpoint or denylist D. credential representing granted authorization that a client presents to access a protected resource
11. Which term means: "credential representing granted authorization that a client presents to access a protected resource"? Junior A. Access token B. OAuth 2.0 C. Client Credentials flow D. OpenID Connect (OIDC)
12. Which statement is correct? Junior A. Access token — authentication layer built on OAuth 2.0 that adds an ID token proving the user's identity B. Access token — JSON Web Token, a signed (and optionally encrypted) token with header, payload claims, and signature C. Access token — credential representing granted authorization that a client presents to access a protected resource D. Access token — deprecated OAuth flow returning tokens directly in the redirect URL, vulnerable to leakage
13. What is ID token ? Junior A. endpoint a resource server calls to check whether a token is active and its associated metadata B. OAuth flow where the client exchanges a short-lived code for tokens via a back-channel request C. Proof Key for Code Exchange, an extension protecting the authorization code flow against interception, required for public clients D. OIDC token (a JWT) asserting the authenticated user's identity to the client application
14. Which term means: "OIDC token (a JWT) asserting the authenticated user's identity to the client application"? Junior A. Client Credentials flow B. PKCE C. ID token D. Token audience confusion
15. Which statement is correct? Junior A. ID token — long-lived credential used to obtain new access tokens without re-authenticating the user B. ID token — accepting a token minted for a different audience, enabling cross-service token reuse C. ID token — OIDC token (a JWT) asserting the authenticated user's identity to the client application D. ID token — opaque value tying an OAuth authorization request to its callback to prevent CSRF
16. What is Refresh token ? Junior A. long-lived credential used to obtain new access tokens without re-authenticating the user B. authentication layer built on OAuth 2.0 that adds an ID token proving the user's identity C. JSON Web Encryption, a JWT variant whose payload is encrypted rather than merely signed D. OAuth mechanism limiting the specific permissions an access token grants to a resource
17. Which term means: "long-lived credential used to obtain new access tokens without re-authenticating the user"? Junior A. Refresh token B. JWT claims C. OpenID Connect (OIDC) D. JWKS
18. Which statement is correct? Junior A. Refresh token — long-lived credential used to obtain new access tokens without re-authenticating the user B. Refresh token — deprecated OAuth flow returning tokens directly in the redirect URL, vulnerable to leakage C. Refresh token — authorization framework letting an app obtain delegated access to resources without sharing credentials D. Refresh token — Proof Key for Code Exchange, an extension protecting the authorization code flow against interception, required for public clients
19. What is Authorization Code flow ? Mid A. OAuth flow where the client exchanges a short-lived code for tokens via a back-channel request B. Proof Key for Code Exchange, an extension protecting the authorization code flow against interception, required for public clients C. JSON Web Encryption, a JWT variant whose payload is encrypted rather than merely signed D. deprecated OAuth flow returning tokens directly in the redirect URL, vulnerable to leakage
20. Which term means: "OAuth flow where the client exchanges a short-lived code for tokens via a back-channel request"? Mid A. Scope B. JWT claims C. Authorization Code flow D. ID token
21. Which statement is correct? Mid A. Authorization Code flow — authentication layer built on OAuth 2.0 that adds an ID token proving the user's identity B. Authorization Code flow — prompt where a resource owner approves the specific scopes an app is requesting C. Authorization Code flow — OAuth flow for machine-to-machine access where the app authenticates as itself with no user D. Authorization Code flow — OAuth flow where the client exchanges a short-lived code for tokens via a back-channel request
22. What is JWT claims ? Mid A. long-lived credential used to obtain new access tokens without re-authenticating the user B. OAuth mechanism limiting the specific permissions an access token grants to a resource C. credential representing granted authorization that a client presents to access a protected resource D. statements in a token payload such as iss (issuer), sub (subject), aud (audience), and exp (expiry)
23. Which term means: "statements in a token payload such as iss (issuer), sub (subject), aud (audience), and exp (expiry)"? Mid A. alg:none vulnerability B. Access token C. JWT claims D. Token audience confusion
24. Which statement is correct? Mid A. JWT claims — OAuth flow where the client exchanges a short-lived code for tokens via a back-channel request B. JWT claims — JSON Web Key Set endpoint publishing the public keys clients use to verify a token's signature C. JWT claims — statements in a token payload such as iss (issuer), sub (subject), aud (audience), and exp (expiry) D. JWT claims — prompt where a resource owner approves the specific scopes an app is requesting
25. What is Scope ? Mid A. JSON Web Token, a signed (and optionally encrypted) token with header, payload claims, and signature B. OAuth flow where the client exchanges a short-lived code for tokens via a back-channel request C. OIDC token (a JWT) asserting the authenticated user's identity to the client application D. OAuth mechanism limiting the specific permissions an access token grants to a resource
26. Which term means: "OAuth mechanism limiting the specific permissions an access token grants to a resource"? Mid A. Consent screen B. Refresh token rotation C. alg:none vulnerability D. Scope
27. Which statement is correct? Mid A. Scope — Proof Key for Code Exchange, an extension protecting the authorization code flow against interception, required for public clients B. Scope — accepting a token minted for a different audience, enabling cross-service token reuse C. Scope — credential representing granted authorization that a client presents to access a protected resource D. Scope — OAuth mechanism limiting the specific permissions an access token grants to a resource
28. What is Bearer token ? Mid A. authentication layer built on OAuth 2.0 that adds an ID token proving the user's identity B. statements in a token payload such as iss (issuer), sub (subject), aud (audience), and exp (expiry) C. token granting access to whoever presents it, requiring transport encryption and careful storage D. OAuth mechanism limiting the specific permissions an access token grants to a resource
29. Which term means: "token granting access to whoever presents it, requiring transport encryption and careful storage"? Mid A. OpenID Connect (OIDC) B. alg:none vulnerability C. Bearer token D. Access token
30. Which statement is correct? Mid A. Bearer token — token granting access to whoever presents it, requiring transport encryption and careful storage B. Bearer token — OAuth flow for machine-to-machine access where the app authenticates as itself with no user C. Bearer token — JWT attack where the signature algorithm is set to none so an unsigned token is wrongly accepted D. Bearer token — Demonstrating Proof-of-Possession that binds a token to a client key so a stolen token is unusable Showing 30 of 69 OAuth & OIDC & JWT questions — the full set, with answers, explanations and an AI tutor on every question, is inside.