Okta Certified Developer Sample Questions & Practice Test

Okta Certified Developer is a developer-focused route for candidates who build or integrate applications with OAuth 2.0, OpenID Connect, APIs, SDKs, SCIM, hooks, claims, scopes, and secure sign-in patterns.

Use this page to preview the kind of integration reasoning an Okta Developer practice route should test. The questions below are original IT Mastery sample questions, not official Okta exam questions.

What this route should test

• choosing secure OAuth 2.0 and OpenID Connect flows for application scenarios
• designing claims, scopes, redirect URIs, token validation, and API access safely
• using SCIM, hooks, and APIs for lifecycle and integration automation
• troubleshooting developer integrations without weakening security controls

Sample Exam Questions

Question 1

Topic: authorization code flow

A server-side web application needs user sign-in and secure token handling. Which flow is generally the best fit?

• A. Implicit flow with tokens exposed in the browser URL
• B. Resource owner password flow for every user
• C. Authorization code flow with appropriate client authentication and redirect URI validation
• D. Sending the user’s password to every API

Best answer: C

Explanation: Authorization code flow is commonly used for server-side web apps because tokens can be handled by the backend and redirect URIs can be controlled.

Question 2

Topic: PKCE

Why is PKCE important for public clients such as mobile or single-page applications?

• A. It helps protect the authorization code exchange when the client cannot keep a secret
• B. It disables token validation
• C. It makes every redirect URI valid
• D. It stores passwords in source code

Best answer: A

Explanation: PKCE adds a code verifier and challenge to reduce interception risk for public clients that cannot safely store a client secret.

Question 3

Topic: scopes

An API should allow an app to read a user’s profile but not change it. What should the developer configure?

• A. A broad administrator token
• B. No authorization server
• C. A read-only scope aligned to the API permission needed
• D. A shared service account password in JavaScript

Best answer: C

Explanation: Scopes express requested API permissions. Narrow read-only scopes support least privilege.

Question 4

Topic: token validation

A backend API receives an access token. What should it validate before trusting the request?

• A. The user’s screen size
• B. Issuer, audience, signature, expiration, and required scopes or claims
• C. Whether the token string looks long
• D. The app’s marketing category

Best answer: B

Explanation: APIs should validate token issuer, audience, signature, expiration, and authorization claims or scopes. Length alone does not prove trust.

Question 5

Topic: redirect URIs

Why should redirect URIs be registered exactly rather than broadly wildcarded?

• A. To make phishing easier
• B. To bypass MFA
• C. To disable sign-in
• D. To reduce the chance that authorization responses are sent to an attacker-controlled location

Best answer: D

Explanation: Redirect URI control is central to OAuth and OIDC security. Loose redirect rules can expose codes or tokens.

Question 6

Topic: ID token

What is the primary purpose of an ID token in an OpenID Connect flow?

• A. It proves that a user authenticated and provides identity claims to the client
• B. It replaces every API access token
• C. It stores the user’s password
• D. It configures network routing

Best answer: A

Explanation: ID tokens are for authentication and identity claims. Access tokens are normally used for API authorization.

Question 7

Topic: SCIM

An application needs automated user provisioning and deprovisioning from Okta. Which standard is commonly relevant?

• A. SMTP only
• B. CSS
• C. Local printer sharing
• D. SCIM

Best answer: D

Explanation: SCIM supports standardized identity provisioning and lifecycle operations between identity providers and applications.

Question 8

Topic: event hooks

A team wants an external service to react when a user is created or deactivated. Which integration pattern fits?

• A. Hard-coded user passwords
• B. Event hooks or a similar event-driven integration
• C. Manual screenshots
• D. Disabling logs

Best answer: B

Explanation: Event-driven integrations can notify external systems about lifecycle events, enabling automation without polling everything manually.

Question 9

Topic: API rate limits

An integration starts failing intermittently during a bulk sync. What should the developer check?

• A. The app icon color
• B. Whether logs should be deleted
• C. API rate limits, retry behavior, pagination, batching, and error handling
• D. The number of office chairs

Best answer: C

Explanation: Bulk integrations can hit API limits or fail because of weak retry and pagination logic. Developers should design for platform constraints.

Question 10

Topic: claims

An application needs the user’s department in its ID token. What should the developer review?

• A. Whether all users should be admins
• B. The network cable length
• C. Payroll approval status
• D. Claim configuration, profile attributes, mappings, and authorization server behavior

Best answer: D

Explanation: Claims depend on profile data, mappings, authorization server settings, and token configuration. Missing claims usually require checking those sources.

Question 11

Topic: client secret

Where should a confidential application’s client secret be stored?

• A. In a secure server-side secret store or equivalent protected configuration
• B. In public client-side JavaScript
• C. In a public repository README
• D. In an email thread

Best answer: A

Explanation: Confidential-client secrets must be protected on the server side. Public clients should use patterns such as PKCE rather than embedded secrets.

Question 12

Topic: troubleshooting

Users see a redirect URI mismatch error during sign-in. What should be checked first?

• A. The application nickname only
• B. Whether MFA should be disabled globally
• C. The exact redirect URI sent by the app compared with the registered redirect URI
• D. The user’s monitor resolution

Best answer: C

Explanation: Redirect URI mismatch errors usually mean the app’s requested callback URI does not exactly match the registered value.

Quick Developer checklist

Related pages

• Okta Certified Professional
• Okta Certified Administrator
• GitHub Advanced Security