The primary security advantage of the OAuth 2.0 framework over a static API key is the use of short-lived access tokens. Client credentials (client ID and secret) are long-lived and highly sensitive. They are used to obtain a temporary access token with a limited scope and expiration time. If this access token is compromised, the attacker only has access for a short duration. The underlying client credentials remain secure and do not need to be revoked or reissued, preventing significant service disruption. This separation of long-term credentials from short-term access credentials is a core security principle of OAuth 2.0.

B. If the access token is compromised, it can be exchanged for an API key

This is incorrect. Exchanging a temporary, compromised credential for a permanent one like an API key would be a severe security anti-pattern.

C. If the client ID is compromised, it can be exchanged for an API key

This describes a non-standard and insecure process. The client ID is part of the primary credentials and is not exchanged for other credential types.

D. If the client secret is compromised, the client credentials do not have to be reissued

This is false. The client secret is a confidential credential. If it is compromised, the entire client credential pair must be considered compromised and must be reissued immediately.

1. The OAuth 2.0 Authorization Framework (RFC 6749): Section 1.5, "Access Token", states, "The short lifespan of the access token is a security benefit, as it limits the amount of time an attacker can use a stolen token." This directly supports the rationale that a compromised token is a limited-duration risk.

2. MuleSoft Documentation - OAuth 2.0a provider: In the "OAuth Dance" section, the documentation describes the flow where a client uses its credentials to obtain a temporary access token, implicitly separating the lifecycle of the two credentials. This architecture is the basis for the advantage described in the correct answer.

3. Anypoint Platform Development: Fundamentals (Mule 4) Student Manual: Module 11, "Controlling API Access," explains that OAuth 2.0 policies provide more robust security than simpler schemes. It emphasizes that access tokens are granted for a limited time, reducing the risk associated with a credential leak compared to a static key that is valid until manually revoked.