Study. uk . com
  1. Home
  2. All questions
  3. Question 350

CISSP study material · question 350 of 500

Which two benefits does RFC 6749 attribute to the access token acting as an abstraction over the underlying authorization grant? Choose two.

  1. The resource server need understand only the token rather than a range of authentication methods.
  2. Tokens can be issued more restrictively than the grant used to obtain them.
  3. The token can be reused as a refresh token when it expires.
  4. The token removes the need for the resource owner to authenticate at all.
Show the answer

Answer: B. Tokens can be issued more restrictively than the grant used to obtain them.
A. The resource server need understand only the token rather than a range of authentication methods.

Issuing tokens narrower than the grant becomes possible, and only the token itself has to be understood, sparing the resource server many authentication schemes.

Source: RFC 6749 (IETF) — RFC 6749 > 1.4 Access Token

Challenge yourself on this topic → Study as cards