Microsoft Graph

Practice questions

1. Question 1Q-59C45D

   A signed-in user uses an ASP.NET Core web application to read their own Microsoft Graph profile through the /me endpoint. Which permission and authorization approach is appropriate?

   1. A.Delegated User.Read permission obtained through an interactive sign-in flow
   2. B.Application User.Read.All permission obtained through the client credentials flow
   3. C.Delegated Mail.Read permission obtained through an interactive sign-in flow
   4. D.Application Directory.ReadWrite.All permission obtained through the client credentials flow
   See the answer and solution
2. Question 2Q-B71F13

   A background .NET worker uses Microsoft Graph to list all users in a tenant. It runs without a signed-in user and uses the client credentials flow. The application should follow least privilege. Which configuration is required?

   1. A.Delegated User.Read permission and an interactive user sign-in
   2. B.Application User.Read.All permission with tenant administrator consent
   3. C.Delegated Directory.Read.All permission without administrator consent
   4. D.Application Mail.Read permission with tenant administrator consent
   See the answer and solution
3. Question 3Q-559DE2

   A single-page application calls a protected middle-tier API with an access token. The middle tier must call the Microsoft Graph /me endpoint on behalf of the same user. What is the correct security design?

   1. A.Forward the SPA's access token directly to Microsoft Graph
   2. B.Use the client credentials flow so Graph receives the middle tier's application identity
   3. C.Validate the incoming token and use the OAuth 2.0 on-behalf-of flow to obtain a Graph delegated access token
   4. D.Store the user's password in the middle tier and use it to request a Graph token
   See the answer and solution
4. Question 4Q-C2F296

   A mobile application allows a signed-in employee to view the employee's upcoming calendar events. The application does not need to access calendars when no user is signed in. Which Microsoft Graph permission should the application request?

   1. A.Delegated Calendars.Read
   2. B.Application Calendars.Read
   3. C.Delegated Calendars.ReadWrite
   4. D.Application Calendars.ReadWrite
   See the answer and solution
5. Question 5Q-85240E

   An Azure Function runs nightly without a signed-in user and uses the Microsoft Graph .NET SDK with a service principal. The required Microsoft Graph application permissions have already been configured and admin consent has been granted. Which scope should be supplied when creating the Graph client for client-credentials authentication?

   1. A.User.Read
   2. B.https://graph.microsoft.com/.default
   3. C.https://login.microsoftonline.com/.default
   4. D.offline_access
   See the answer and solution