350-901 practice questions 311–320

1. Question 311 · 385 in bank

   In the three-legged OAuth2 authorization workflow, which entity grants access to a protected resource?

   • Aresource owner
   • Bclient
   • Cresource server
   • Dauthorization server

   Show answer

   Answer: A

   Explanation

   Cisco DEVCOR Study Guide 350-901 2022 edition, page 69, section 2.5, "Describe the steps in the OAuth2 three‐legged authorization code grant flow": (B) In this step, the resource owner decides whether to grant the requested access to the client application. In the case of Google, it would display a consent window that shows the name of the application, Google services that it is requesting access to, and a summary of the scopes of access to be granted. The user can then consent to grant access or refuse the request. I'll go with A

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation

   Next question

2. Question 312 · 385 in bank

   Select 2

   What are two steps in the OAuth2 protocol flow? (Choose two.)

   • AThe user is authenticated by the authorization server and granted an access token.
   • BThe user's original credentials are validated by the resource server and authorization is granted.
   • CThe user indirectly requests authorization through the authorization server.
   • DThe user requests an access token by authentication and authorization grant presentation.
   • EThe user requests the protected resource from the resource server using the original credentials.

   Show answer

   Answer: CE

   Explanation

   A can't be correct because a user is not granted an access token. It's issued to a client / app. B can't be correct because the credentials are validated by the authorization server. The resource server validates client's / app's access token. D can't be correct because a user doesn't request an access token. A client / app does. I would go with C because a user wants an authorization server to authorize the client /app. E could be correct because user requests a protected resource (which is accessed by a client / app) and he uses his original credentials which are not shared with the client / app. It uses the authorization code grant flow to get access.

   Source: Adapted from community discussion — enough98

   Next question

3. Question 313 · 385 in bank

   DRAG DROP - Drag and drop the descriptions from the left onto the related OAuth-defined roles on the right. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Authorization Server - Issues access token Client - Makes secured resource requests Resource Owner - Provide access Resource Server - Uses access tokens to accept and respond

   Source: Adapted from community discussion — designated

   

   Next question

4. Question 314 · 385 in bank

   

   Refer to the exhibit. This cURL POST request creates an OAuth access token for authentication with FDM API requests. What is the purpose of the file `@token_data` that cURL is handling?

   • AThis file is given as input to store the access token received from FDM.
   • BThis file is used to send authentication-related headers.
   • CThis file contains raw data that is needed for token authentication.
   • DThis file is a container to log possible error responses in the request.

   Show answer

   Answer: C

   Next question

5. Question 315 · 385 in bank

   What is the result of a successful OAuth2 authorization grant flow?

   • AThe third-party service is provided with a token that allows actions to be performed.
   • BThe user has the application rights that correspond to the user's role within the application's database.
   • CThe application is provided with a token that allows actions on services on the user's behalf.
   • DThe user has administrative rights to the application's backend services.

   Show answer

   Answer: C

   Explanation

   Answer: C The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service, either on behalf of a resource owner by orchestrating an approval interaction between the resource owner and the HTTP service or by allowing the third-party application to obtain access on its own behalf.

   Source: Adapted from community discussion — Teringzooi

   Next question

6. Question 316 · 385 in bank

   In the three-legged OAuth2 process, after the authorization server presents a form to the resource owner to grant access, what is the next step?

   • AThe resource owner authenticates and optionally authorizes with the authorization server.
   • BThe user who owns the resource initiates a request to the OAuth client.
   • CIf the resource owner allows access, the authorization server sends the OAuth client a redirection.
   • DA form to allow or restrict access is submitted by the owner of the resource.

   Show answer

   Answer: D

   Explanation

   A - This happens earlier in the flow, before authz server presents form to grant access. B - Definitely not C - Happens later in the flow. D - Correct answer. Kudos to Johnno26 for the link which has every step word for word!

   Source: Adapted from community discussion — python_tamer

   Next question

7. Question 317 · 385 in bank

   Which OAuth mechanism enables clients to continue to have an active access token without further interaction from the user?

   • Arefresh grant
   • BJWT
   • Cpassword grant
   • Dpreshared key

   Show answer

   Answer: A

   Explanation

   Answer: A The Refresh Token grant type is used by clients to exchange a refresh token for an access token when the access token has expired. This allows clients to continue to have a valid access token without further interaction with the user. https://oauth.net/2/grant-types/refresh-token/

   Source: Adapted from community discussion — Teringzooi

   Next question

8. Question 318 · 385 in bank

   Select 2

   An organization manages a large cloud-deployed application that employs a microservices architecture across multiple data centers. Reports have been received about application slowness. The container orchestration logs show that faults have been raised in a variety of containers that caused them to fail and then spin up brand new instances. Which two actions can improve the design of the application to identify the faults? (Choose two.)

   • AAutomatically pull out the container that fails the most over a time period.
   • BImplement a tagging methodology that follows the application execution from service to service.
   • CAdd logging on exception and provide immediate notification.
   • DDo a write to the datastore every time there is an application failure.
   • EImplement an SNMP logging system with alerts in case a network link is slow.

   Show answer

   Answer: BC

   Explanation

   -> A. Automatically pull out the container that fails the most over a time period. Stupid to do this, it will break your app -> B. Implement a tagging methodology that follows the application execution from service to service. -> C. Add logging on exception and provide immediate notification. Observability gives insight in your problems, tagging & loggin do this -> D. Do a write to the datastore every time there is an application failure. So the app failed, what are we going to write to the datastore ? App can’t do this anymore since it crashed. Docker or Kubernetes are doing this probably but don’t give any insight into why it’s crashed. -> E. Implement an SNMP logging system with alerts in case a network link is slow. Network speed alone has nothing to do with a crashing container.

   Source: Adapted from community discussion — skysoft

   Next question

9. Question 319 · 385 in bank

   A developer is building an application to access a website. When running the application, an HTTP 403 error code has been received. How should the application be modified to handle this code?

   • ACreate a loop on cancel the operation and run a new one after the code is received.
   • BUse exponential backoff when retrying distributed services and other remote endpoints.
   • CBuild a try/except around the urlopen to find errors occurring in the request.
   • DRedirect the request to an internal web server and make a new request from the internal resource.

   Show answer

   Answer: C

   Explanation

   HTTP 403 means Forbidden. The user has successfully authenticated, but they are not allowed access to whatever they are trying to access. No amount of backoffs or retries or looping is going to fix this. They can retry forever and will be told "no" repeatedly. You have to build in error handling to gracefully inform the user they just don't have permission to access the resource, and let them choose where to go from there. The error handling in Python is try/except around the HTTP GET request.

   Source: Adapted from community discussion — kirrim

   Next question

10. Question 320 · 385 in bank

    

    Refer to the exhibit. Which API call does an engineer use to delete the FQDN object?

    • ADELETE /api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f
    • BDELETE /api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f/object/fqdns/005056BB-0B24-0ed3-0000-858993545263
    • CDELETE /api/fmc_config/v1/domain?id=e276abec-e0f2-11e3-8169-6d9ed49b625f
    • DDELETE /api/fmc_config/v1/domain/e276abec-e0f2-11e3-8169-6d9ed49b625f/object/fqdns?id=005056BB-0B24-0ed3-0000-858993545263

    Show answer

    Answer: B

    References

    • Cisco documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

350-901 practice, question 311. 385 questions available.