mediumMultiple SelectObjective-mapped
200-901 Practice Question: An application is secured using OAuth 2.0 for…
An application is secured using OAuth 2.0 for Cisco Webex API access. Which three components are involved in the authorization code grant flow? (Choose three.)
⚠ Common exam trap
Cisco often tests the distinction between the components used in the initial authorization code grant flow versus those used in subsequent token refresh, causing candidates to incorrectly include the Refresh Token as a required component of the initial flow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client Secret
The authorization code grant flow in OAuth 2.0 requires the client to present its Client ID and Client Secret to authenticate itself to the authorization server. The flow begins by requesting an authorization code, which is then exchanged for an access token. The three components explicitly involved in this exchange are the Client Secret (A), Client ID (B), and Authorization Code (C).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Client Secret
Why this is correct
Client Secret authenticates the application.
- ✓
Client ID
Why this is correct
In the OAuth 2.0 authorization code grant flow, the Client ID is a public identifier issued by the authorisation server (e.g., Cisco Webex Identity) that uniquely identifies the application to the server during the initial authorisation request. The stem specifies "authorization code grant flow," which requires the client to present its Client ID in the redirect URI to obtain the authorisation code, satisfying the constraint that the client must be registered and recognised before exchanging credentials for tokens.
- ✓
Authorization Code
Why this is correct
Authorization code is exchanged for an access token.
- ✗
Refresh Token
Why it's wrong here
Refresh token is used to obtain new access tokens after expiry, but is not part of the initial authorization code flow.
- ✗
API Key
Why it's wrong here
API keys are not used in standard OAuth 2.0 flows.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.