RFC 8693 Quiz

**Explanation:** A: This indicates the desired output token type, not the subject principal. B: The subject token represents the party that is the subject of the requested token. C: This is returned in the response to identify the issued token type.

**Explanation:** A: The subject credential uses subject_token_type instead. B: The requested output type is independent of actor-token typing. C: The authorization server needs the actor token's type to interpret the optional credential.

**Explanation:** A: They let the client identify intended resource servers or logical audiences. B: The subject token and its claims identify the subject, not resource or audience parameters. C: Token algorithm selection is not the purpose of these target parameters.

**Explanation:** A: The problem is the requested target set rather than necessarily the input grant. B: This error indicates that the requested resource or audience combination is invalid or unacceptable. C: Policy rejection of a target is not a temporary availability failure.

**Explanation:** A: Actor identity is represented by claims such as act, not issued_token_type. B: The token exchange response precedes later resource-server acceptance. C: The response explicitly reports the issued token type even when it differs from the requested type.

**Explanation:** A: The top-level act claim identifies the present actor in the delegation chain. B: The target belongs in audience or resource information, not the actor claim. C: The act claim models acting parties and is not an issuer-only field.

**Explanation:** A: Dropping history loses the delegation path needed by policy and audit. B: Nested act objects express the current actor followed by prior actors. C: Scope expresses requested privileges and is not an actor-chain structure.

**Explanation:** A: The authorization server must validate tokens and authorize the requested exchange. B: An actor token identifies an actor but does not bypass exchange policy. C: RFC 8693 provides the exchange framework without granting every requested authority transition.

**Explanation:** A: The authorization server may issue one but successful exchange does not require it. B: RFC 8693 does not require renewal rights for every exchange. C: Actor-token presence does not create a mandatory refresh-token response.

**Explanation:** A: Blind scope propagation can grant privileges inappropriate for the target service. B: These checks prevent token transformation from silently widening authority or losing accountability. C: A token authorizes or represents access context and is not evidence that an operation completed.