CCSP Cloud Application Security Practice Question
A fintech startup deploys a customer-facing web application on Azure App Service. The application uses OAuth 2.0 with Azure AD for authentication. Recently, users report being logged out unexpectedly during active sessions. Security logs show multiple token refresh attempts failing with 'invalid_grant' errors. The application uses a standard library for token management. What is the most likely cause and recommended action?
⚠ Common exam trap
ISC2 often tests the distinction between token refresh errors (invalid_grant) and other OAuth 2.0 errors (e.g., throttling, consent issues), and candidates mistakenly attribute the problem to PKCE or throttling without recognizing that token lifetime misconfiguration is the most common cause of unexpected logouts in Azure AD.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The access token and refresh token lifetimes are misconfigured; align token lifetimes
The 'invalid_grant' error during token refresh typically indicates that the refresh token has expired or been revoked. In Azure AD, refresh token lifetimes are configurable and, if set too short or misaligned with the access token lifetime, users will be logged out unexpectedly when the refresh token expires before a new access token is requested. The standard library correctly handles the OAuth 2.0 flow, but the token lifetime configuration in the Azure AD app registration is the root cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Azure AD API is throttling requests; implement exponential backoff
Why it's wrong here
Throttling would return HTTP 429, not 'invalid_grant'.
- ✓
The access token and refresh token lifetimes are misconfigured; align token lifetimes
Why this is correct
If the access token outlives the refresh token, refresh attempts fail.
- ✗
The authorization code was reused; implement PKCE to prevent reuse
Why it's wrong here
Authorization code reuse is prevented by the OAuth server; the error is not typical.
- ✗
The user consent was revoked; advise users to re-consent
Why it's wrong here
Revoked consent would show 'consent_required' errors, not 'invalid_grant'.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.