Okta Certified Developer 問題練習

Question No : 1
Which of the following Oauth 2.0 flow(s) supports Access Tokens?

• A.Authorization Code
• B.Authorization Code with PKCE
• C.Implicit
• D.Resource Owner Password
• E.Client Credentials

答えを確認する

正解:

Question No : 2
In regards to OpenID Connect & OAuth 2.0 API, '/.well-known/openid-configuration' is the endpoint which has the following use:

• A.Return OpenID Connect metadata related to the specified authorization server
• B.Return OAuth 2.0 metadata related to the specified authentication server
• C.Interact with the resource owner and obtain an authorization grant
• D.Return information about a token

答えを確認する

正解:

Question No : 3
'invalid_request' error is thrown when:

• A.The request structure was invalid
• B.The basic authentication header is malformed
• C.Both header and form parameters were used for authentication
• D.No authentication information was provided

答えを確認する

正解:

Question No : 4
'invalid_grant' error is thrown when:

• A.The 'code', 'refresh_token', or 'username' and 'password' combination is invalid
• B.The 'redirect_uri' doesn't match the one used in the authentication request
• C.The 'redirect_uri' doesn't match the one used in the authorization request

答えを確認する

正解:

Question No : 5
'scope' is required only if 'password' is:

• A.The 'grant_type'
• B.The 'claim'
• C.The 'password'

答えを確認する

正解:

Question No : 6
'redirect_uri' is only required if 'grant_type' is:

• A.'client_credentials'
• B.'authorization_code'
• C.'refresh_token'

答えを確認する

正解:

Question No : 7
Okta requires the OAuth 2.0 'state' parameter on all requests to the '/authorize' endpoint, in order to:

• A.Prevent XSS (Cross Site Scripting) attacks
• B.Prevent MITM (Man-in-the-middle) attacks
• C.Prevent CSRF (Cross-site Request Forgery) attacks
• D.Statement is False in its entirety as Okta does not have a requirement for that

答えを確認する

正解:

Question No : 8
If 'consent' value is set for 'prompt', then:

• A.Okta consent dialog will be displayed only if the user hasn't already given consent
• B.Okta consent dialog might still be displayed, even if the user has already given consent
• C.Statement is False, as 'consent' is not a value for 'prompt' parameter

答えを確認する

正解:

Question No : 9
For the 'prompt' parameter, there are several values that it can take:

• A.'none'
• B.'login'
• C.'login consent'
• D.'consent'
• E.'consent login'

答えを確認する

正解:

Question No : 10
If no prompt parameter is specified, the behavior(s) that occur(s) is / are:

• A.If there is already and Okta session active, the user is silently authenticated
• B.If there is not an Okta session active already, the user is prompted to authenticate
• C.If scopes are requested that require consent and consent isn't yet given by the authenticated user, the user is prompted to give consent

答えを確認する

正解:

Question No : 11
If you use a JWT for client authentication ('client_secret_jwt' or 'private_key_jwt'), you can use the following token claims:

• A.The 'jti' token claim. The 'jti' claim fails the request if the expiration time is more than one hour in the future or has already expired
• B.The 'exp' token claim. The 'exp' claim fails the request if the expiration time is more than one hour in the future or has already expired
• C.The 'exp' token claim. If 'exp' is specified, the token can only be used once. So, for example, subsequent token requests won't succeed
• D.The 'jti' token claim. If 'jti' is specified, the token can only be used once. So, for example, subsequent token requests won't succeed

答えを確認する

正解:

Question No : 12
If your client's 'token_endpoint_auth_method' is 'either client_secret_basic' or 'client_secret_post' you need to include the client secret in outgoing requests.

• A.Statement is False in its entirety
• B.For 'client_secret_basic': Provide the 'client_id' and 'client_secret' values in the Authorization header as a Basic auth base64-encoded string within the POST request, as in: Authorization: Basic ${Base64(<client_id>:<client_secret>)}
• C.For 'client_secret_post': Provide the 'client_id' and 'client_secret' as additional parameters in the POST request body
• D.For 'client_secret_basic': Provide the 'client_id' and 'client_secret' values as additional parameters in the GET request body
• E.For 'client_secret_basic': Provide the 'client_id' and 'client_secret' values in the Authorization header as a Basic auth non-base64-encoded string within the POST request, as in: Authorization: Basic ${<client_id>:<client_secret>}

答えを確認する

正解:

Question No : 13
Use these method(s) when the client has a client secret. Okta supports the following authentication methods:

• A.'client_secret_basic'
• B.'client_secret_jwt'
• C.'client_secret_post'

答えを確認する

正解:

Question No : 14
When you want higher security in the flow, use:

• A.'consent_method' set to 'REQUIRED'
• B.'consent' set to 'REQUIRED'
• C.'private_key_jwt'
• D.'none' as the client secret

答えを確認する

正解:

Question No : 15
'none' - Use this with clients that don't have a client secret:

• A.Such as applications that use the authorization code flow with PKCE
• B.Not with applications that use the authorization code flow with PKCE
• C.Such as applications that use the implicit flow
• D.Not with applications that use the implicit flow

答えを確認する

正解: