C1000-138 practice question 5 of 15

Which two grant types are supported for native and third-party OAuth providers?

Full set: 60 questions

Answer options

A: Explicit

B: Application (client-credentials) Correct answer

C: Inhibit

D: Exhibit

E: Implicit Correct answer

Correct Answer:

B. Application (client-credentials); E. Implicit

Explanation

IBM API Connect supports several OAuth 2.0 grant types for both native and third-party OAuth providers. The "Application" grant type corresponds to the clientcredentials grant, used for machine-to-machine communication. The "Implicit" grant type is a simplified flow intended for applications running in a browser (single-page applications), where the access token is returned directly to the client. These are two of the standard grant types that can be configured when defining an OAuth provider security definition in API Connect.

Why Incorrect

A. Explicit is not a standard OAuth 2.0 grant type name. The "Authorization Code" grant is sometimes referred to as the explicit grant, but "Explicit" itself is not a supported option.
C. Inhibit is not a valid OAuth grant type. It is an irrelevant term in this context.
D. Exhibit is not a valid OAuth grant type. It is an irrelevant term in this context.

References

- IBM API Connect v10.x Documentation, "Configuring a native OAuth provider". This section lists the supported grant types, which include "Implicit" and "Application" (clientcredentials).

- IBM API Connect v10.x Documentation, "OAuth grant types". This page details the supported grant types, explicitly mentioning implicit and clientcredentials (which is configured as the "Application" grant type in the UI).

Question breakdown

Tests: Configure native and third-party OAuth providers
Difficulty: Easy

Key idea: API Connect OAuth providers support the standard OAuth 2.0 grants: implicit, application (client credentials), password, and access code.

How to reach the answer

List the standard OAuth 2.0 grants that API Connect exposes: implicit, application, password, access code.
Match the options against that list.
'Application (client-credentials)' and 'Implicit' match.
'Explicit', 'Inhibit' and 'Exhibit' are not OAuth grant types, so B and E are the answer.

Each option

AIncorrect. 'Explicit' is not a grant type; it is a distractor contrasting with implicit (the code flow is called access code).
BCorrect. The application (client credentials) grant is supported for machine-to-machine access.
CIncorrect. 'Inhibit' is not an OAuth grant type.
DIncorrect. 'Exhibit' is not an OAuth grant type.
ECorrect. The implicit grant is supported, returning the token directly to the client.

Common trap: 'Explicit' sounds like the natural counterpart to 'Implicit', but the redirect-based code flow is named access code (authorization code).

In practice: When creating a native OAuth provider in Cloud Manager, you tick which grants (implicit, application, password, access code) the provider will allow.

Remember: API Connect OAuth grants are implicit, application, password and access code.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free C1000-138 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test