Salesforce Certified Identity and Access Management Practice

OAuth tokens must be protected from interception using Transport Layer Security (TLS) to ensure security. TLS encrypts the communication between the client and the server, preventing unauthorized access to the OAuth tokens. Option B, a longer lifetime for authorization codes, does not affect the security of the OAuth tokens. Option C is incorrect because session IDs are not a type of OAuth token. Option D is incorrect because OAuth tokens are used to make authenticated requests on behalf of the user, not for the user.