hardMultiple ChoiceObjective-mapped
200-901 Practice Question: A security team is developing an application that…
A security team is developing an application that collects network alerts from Cisco Firepower Management Center (FMC) API. The API requires OAuth2 authorization code grant flow. After obtaining an authorization code, what must the application do to get an access token?
⚠ Common exam trap
Cisco often tests the misconception that the authorization code itself can be used as a bearer token or decoded to reveal the access token, when in fact it must be exchanged at the token endpoint with client credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exchange the authorization code for an access token by calling the token endpoint with the code and client credentials.
In the OAuth2 authorization code grant flow, the authorization code is an intermediate credential that must be exchanged for an access token. The application must call the token endpoint, presenting the authorization code along with its client credentials (client ID and client secret) to receive the access token. This exchange is required by RFC 6749 and is a fundamental security measure to ensure the client is authorized to obtain the token.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Resend the authorization request with the code included in the redirect URI.
Why it's wrong here
Repeating the authorization request will generate a new code, not produce an access token.
- ✗
Decode the authorization code using base64 to extract the access token.
Why it's wrong here
The authorization code is not base64-encoded access token; decoding will not produce a usable token.
- ✗
Use the authorization code directly in subsequent API requests as a bearer token.
Why it's wrong here
The authorization code is a temporary credential that must be exchanged for an access token; it cannot be used directly.
- ✓
Exchange the authorization code for an access token by calling the token endpoint with the code and client credentials.
Why this is correct
This is the correct step in the authorization code grant flow.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.