SSCP Access Controls Practice Question
An organization uses OAuth 2.0 for delegated access to a cloud storage API. A third-party application requests an access token to read user files. What is the primary purpose of the access token in OAuth?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To authorize the client to access the resource server on behalf of the user
The access token represents the authorized scope of access granted by the resource owner (user). It is used by the client to access the protected resource (e.g., API) without exposing user credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To encrypt the user's data in transit
Why it's wrong here
Encryption is not the token's purpose.
- ✗
To store the user's credentials in the client application
Why it's wrong here
Credentials should not be stored in the client.
- ✓
To authorize the client to access the resource server on behalf of the user
Why this is correct
Correct. The access token conveys authorization.
- ✗
To authenticate the user to the authorization server
Why it's wrong here
Authentication is handled separately; the token authorizes access.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.