SSCP Access Controls Practice Question
An organization uses OAuth 2.0 for delegated access to a cloud storage API. A third-party application requests an access token to read user files. What is the primary purpose of the access token in OAuth?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To authorize the client to access the resource server on behalf of the user
The access token represents the authorized scope of access granted by the resource owner (user). It is used by the client to access the protected resource (e.g., API) without exposing user credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To encrypt the user's data in transit
Why it's wrong here
Access tokens authorise API requests; transport encryption is provided by TLS, not by the token itself. The option tempts because tokens travel in HTTPS headers and appear security-related, but encryption in transit is a channel property, whereas the token's purpose is delegated authorisation to the resource server.
- ✗
To store the user's credentials in the client application
Why it's wrong here
An access token is a bearer credential granting the client limited, scoped access to the resource server; it never stores user credentials, which remain with the authorization server. The option tempts because tokens do represent authorisation, but credential storage is the resource owner password flow's risk, not the token's purpose.
- ✓
To authorize the client to access the resource server on behalf of the user
Why this is correct
The access token is a credential issued to the client after the user grants authorisation, and the resource server validates it to permit scoped access on the user's behalf. It carries granted permissions rather than the user's password or identity credentials.
- ✗
To authenticate the user to the authorization server
Why it's wrong here
The access token authorises the client to call the resource server; user authentication happens at the authorization server during the authorization grant, producing the token. The option tempts because tokens result from authentication, but the token's purpose is delegated authorisation, not authenticating the user to the authorization server.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.