Microsoft Identity Platform and MSAL

Practice questions

1. Question 1Q-6C5E87

   A .NET desktop application needs to sign a user in interactively and call Microsoft Graph on that user's behalf. The application is registered as a public client and cannot safely store a client secret. Which MSAL.NET approach is most appropriate?

   1. A.Create a ConfidentialClientApplication and call AcquireTokenForClient with the application secret
   2. B.Create a PublicClientApplication and call AcquireTokenInteractive with the required delegated scopes
   3. C.Call the Microsoft Graph API directly without acquiring an access token
   4. D.Create a PublicClientApplication and call AcquireTokenForClient with the user's password
   See the answer and solution
2. Question 2Q-04C40D

   A background Azure App Service must call a protected Azure resource without a signed-in user. The service is registered as a confidential client and has been granted application permission to the resource. Which MSAL.NET call and scope format should it use?

   1. A.AcquireTokenInteractive(new[] { "https://resource-api/.default" })
   2. B.AcquireTokenForClient(new[] { "https://resource-api/.default" })
   3. C.AcquireTokenOnBehalfOf(new[] { "https://resource-api/.default" }, userAssertion)
   4. D.AcquireTokenSilent(new[] { "https://resource-api/User.Read" }, null)
   See the answer and solution
3. Question 3Q-27CE03

   An ASP.NET Core API receives an access token for the signed-in user and must call a downstream API while preserving that user's identity and permissions. The API is registered as a confidential client, and the downstream API has granted the required delegated permission. Which implementation is correct?

   1. A.Use AcquireTokenForClient with the API's client secret and the downstream API's .default scope
   2. B.Use AcquireTokenInteractive so the user signs in again for every downstream request
   3. C.Use AcquireTokenOnBehalfOf with the downstream API's scopes and a UserAssertion created from the incoming access token
   4. D.Forward the incoming access token to the downstream API regardless of its audience
   See the answer and solution
4. Question 4Q-3AB6CE

   A web application signs in a user with Microsoft Identity Platform and receives both an ID token and an access token. The application must call a protected REST API on behalf of the user. Which token should it send to the API?

   1. A.The ID token, because it contains the user's identity claims
   2. B.The access token, because its audience identifies the protected API
   3. C.The refresh token, because it can be exchanged by any API
   4. D.The authorization code, because the API can redeem it for permissions
   See the answer and solution
5. Question 5Q-A3B46D

   An app registration is configured to allow accounts in any Microsoft Entra organization, but not personal Microsoft accounts. Which Microsoft identity platform authority is most appropriate for interactive sign-in?

   1. A.https://login.microsoftonline.com/consumers
   2. B.https://login.microsoftonline.com/organizations
   3. C.https://login.microsoftonline.com/common
   4. D.https://login.microsoftonline.com/8f7c2d10-1234-4d56-9876-123456789abc
   See the answer and solution