What does scoping an API token to a specific task achieve?
Select an answer to reveal the explanation.
Short Explanation
Scoping is damage limitation, not prevention. You still need secret storage and rotation; scoping just limits what the token can do if it leaks.
Full Explanation
Scoping an API token to a specific task limits the damage if the token is exposed because the holder can only perform the operations the automation required. Scope determines what an attacker in possession of the token can actually do, so a read-only reporting token is a far smaller problem than an administrative one. Scoping cannot prevent exposure; it only reduces the consequence. A scoped token is still a valid credential and must be protected securely. Rotation also applies regardless of scope, because a narrow token left valid forever is still an unbounded exposure. For the exam, treat scoping, secret storage, and rotation as complementary controls.