Which statement best describes OAuth?

• A. A polling-based data retrieval protocol
• B. A user authentication protocol
• C. An authorization protocol that allows a user to grant limited access to resources without exposing credentials
• D. A protocol for real-time messaging

Answer: (C)

OAuth is an authorization protocol that lets a user grant a third-party application limited access to resources without sharing their credentials. Instead of giving the app their username and password, the user authorizes access and receives a token that the app can use to access only the permitted resources for a limited time. This tokenization allows fine-grained control (scopes) and revocation, keeping the user’s credentials secure. It also separates the roles of the resource owner, the authorization server, and the resource server, which is a core strength of this approach.

The other descriptions don’t fit OAuth. Polling-based data retrieval describes a pattern for repeatedly checking for updates, not a mechanism for authorization. A user authentication protocol focuses on proving identity, whereas OAuth is about granting access rights rather than proving who you are. A protocol for real-time messaging refers to communication methods for instant data exchange, not authorization.