mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Is troubleshooting an issue where users are…
A security engineer is troubleshooting an issue where users are unable to access a web application after being authenticated via OAuth 2.0. The users receive a 403 Forbidden error. The application logs show that the access token is valid but does not contain the required scope. What is the most likely cause?
⚠ Common exam trap
Many candidates confuse token validity (which is about signature, expiration, and issuer) with token authorization (which is about scope); candidates often assume a valid token guarantees access, but OAuth 2.0 separates authentication from authorization, and scope is the key authorization attribute.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The authorization server did not grant the requested scope due to user consent settings.
The 403 Forbidden error indicates the resource server received a valid access token but denied access because the token lacks the necessary scope. In OAuth 2.0, the authorization server issues tokens based on the scope granted by the user during consent. If the user did not consent to the required scope (e.g., 'write' instead of 'read'), the token will not include it, causing the resource server to reject the request despite the token being valid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The resource server is configured to expect a different token type.
Why it's wrong here
If the resource server expects a JWT (JSON Web Token) but receives an opaque token, or vice-versa, it will fail to parse or validate the token's structure. This fundamental mismatch typically results in a 400 Bad Request or a 500 Internal Server Error if the server cannot even process the token, or a specific "unsupported token type" error, rather than a 403 Forbidden which implies the token was understood but lacked permission.
- ✗
The client application is not using HTTPS to transmit the token.
Why it's wrong here
Transmitting an access token over unencrypted HTTP is a critical security vulnerability, exposing the token to eavesdropping and potential compromise. While highly insecure, the lack of HTTPS itself does not inherently prevent the resource server from receiving and attempting to validate the token. A 403 Forbidden response indicates the server received and understood the request and token, but denied access based on authorization rules, not transport layer security.
- ✗
The access token expired before being presented to the resource server.
Why it's wrong here
When an access token has expired, the resource server's validation process will identify it as invalid or no longer current. This invalidation typically leads to a 401 Unauthorized response, signaling that the authentication credentials provided are either missing or no longer valid, requiring re-authentication. A 403 Forbidden, conversely, implies the token is valid but the authenticated principal lacks the necessary permissions for the requested action.
- ✓
The authorization server did not grant the requested scope due to user consent settings.
Why this is correct
If the authorization server, often influenced by user consent or policy, did not include a specific required scope within the issued access token, the resource server will deny the request. Upon receiving the token, the resource server inspects its claims, including the 'scope' claim, and determines that the token does not possess the necessary permissions to perform the requested operation, resulting in a 403 Forbidden response. This indicates the user is authenticated but not authorized for that specific action.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.