AZ-301 Exam - Question 178

Question

HOTSPOT -You are designing a software as a service (SaaS) application that will enable Azure Active Directory (Azure AD) users to create and publish surveys. The SaaS application will have a front-end web app and a back-end web API. The web app will rely on the web API to handle updates to customer surveys. You need to design an authorization flow for the SaaS application. The solution must meet the following requirements:✑ To access the back-end web API, the web app must authenticate by using OAuth 2 bearer tokens. ✑ The web app must authenticate by using the identities of individual users. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:.

Examice · Accepted Answer

References:https://docs. microsoft. com/lb-lu/azure/architecture/multitenant-identity/web-api https://docs. microsoft. com/en-us/azure/active-directory/develop/quickstart-v1-dotnet-webapi.

Ekramy_Elnaggar · Answer

This is a repeated question:
https://www.examtopics.com/exams/microsoft/az-301/view/24/

pkum · Answer

Azure AD, Web API are correct answers. 
Please refer auth workflow diagram here: https://docs.microsoft.com/lb-lu/azure/architecture/multitenant-identity/web-api#register-the-web-api-in-azure-ad

blackalbum · Answer

The answer is correct. 
Delegated User Identity: The web API makes authorization decisions based on the user identity.
https://docs.microsoft.com/lb-lu/azure/architecture/multitenant-identity/web-api

pandeya442 · Answer

Repeated one-
Azure AD
Web API

AS007 · Answer

AAD
Web App

jivom · Answer

Access token is generated by Active Directoy but Authorization is always provided by Web Api.
The Web app requests the access token to AD, and the web app then asks API to verify that access token.

Test_Taker_1 · Answer

Says it here plan as day:
https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/web-api

Question Requirements: 
"... must authenticate by using OAuth 2 bearer tokens."
"... authenticate by using the identities of individual users."

The link above offers 2 flows:
1. Delegated User Identity - this isn't the correct because the one below fits better.
2. Application Identity
   - Uses OAUTH
   - Authorization will be performed by Web Application

For both cases, it says that a token must come from an identity providers.

Therefore
Question 1: Azure AD (it's the identity provider)
Question 2: "A web app"

Dlouc · Answer

answer for second part - is Web App
The web API does not get information about the user.
The web API cannot perform any authorization based on the user identity. All authorization decisions are made by the web application.

NKnab · Answer

Using the access token to call the web API
Once you have the token, send it in the Authorization header of the HTTP requests to the web API.

[Removed] · Answer

A perfect example is given here: https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/

sanketshah · Answer

given answer is correct.

AZ-301 Exam - Question 178

Discussion