Which two types of tokens can the app retrieve as part of the authorization flow?

You are developing a server-based web app that will use OAuth2 on behalf of the user and will be registered with the Microsoft identity platform.

Which two types of tokens can the app retrieve as part of the authorization flow? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
A . context token
B . Kerberos token
C . refresh token
D . SAML token
E . access token

Answer: D,E

Explanation:

Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow