Comprehensive and Detailed Explanation From Exact Extract:

Pega’s authentication mechanisms, as outlined in Pega Academy’sSecurity Missionand thePega Certified Lead System Architect Study Guide, include bearer tokens for securing API and web embed interactions. Bearer tokens are used to authenticate and authorize users for multiple requests within a session.

Option A (Correct): A custom bearer token authorizes the level of access a user has to resources (e.g., specific API endpoints or reports) by including accessscope in the token payload. This is a primary use, as documented in theBearer Token Authenticationsection of Pega Community.

Option B (Incorrect): Bearer tokens do not encrypt data; encryption is handled by protocols like HTTPS. Tokens carry authentication data, per theWeb Securitymodule.

Option C (Correct): Bearer tokens authenticate a user for multiple requests over a period (e.g., session duration), reducing the need for repeated logins. This is a key feature, as noted in theAuthentication Mechanismsguidelines.

Option D (Incorrect): Bearer tokens are designed for multiple requests, not single requests. Single-request authentication is typically handled by other mechanisms, per theToken-Based Authenticationmodule.