Which two statements about Webex Teams refresh tokens are true? (Choose two.)

Question

Options

• AThe refresh token is useless without the client ID and client secret.
• BAn attacker can use the refresh token to send messages on behalf of the user.
• CThe refresh token is used to generate a new access token.
• DA new refresh token cannot be granted until the client ID is invalidated.
• EThe refresh token does not expire.

• A
  19% (11)
• B
  63% (36)
• D
  7% (4)
• E
  11% (6)

Explanation

B and C are correct because refresh tokens serve the core OAuth 2.0 purpose of generating new access tokens when the short-lived access token expires (C), and since a refresh token grants the ability to obtain valid access tokens, a stolen one lets an attacker impersonate the user and send messages on their behalf - no password required (B).

Why the distractors are wrong:

• A is incorrect because a refresh token still carries real security risk independently; an attacker with the token can cause harm, making it far from "useless." (This option also contradicts why B is true.)
• D is incorrect because a new refresh token is typically issued during the token refresh flow itself - invalidating the client ID is not a prerequisite.
• E is incorrect because Webex Teams refresh tokens do expire (after 60 days of inactivity), distinguishing them from permanent credentials.

Memory tip: Think of the refresh token as a spare key - it unlocks the house (generates access tokens), and a thief who steals the spare key can walk right in (B), which is exactly why E being false matters: spare keys don't last forever in Webex's world.

No community discussion yet for this question.