ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Because the portal is a confidential server-side application, it can safely store a client secret and exchange an authorization code for access and refresh tokens over a back-channel HTTPS request. The Authorization Code grant was designed for this model: the browser receives only a short-lived code, so the secret and tokens remain hidden from the user. The Implicit grant would return tokens directly to the browser and cannot issue refresh tokens. The Resource Owner Password Credentials grant would force users to enter their passwords into the portal, which is discouraged and often disabled. The Client Credentials grant is meant for service-to-service scenarios without an end user, so it cannot provide user-specific tokens here.