Exam AZ-400 topic 4 question 73 discussion

https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization#restricting-access-by-personal-access-tokens-classic

Organization owners can prevent personal access tokens (classic) from accessing resources owned by the organization. Personal access tokens (classic) will still be able to read public resources within the organization. This setting only controls access by personal access tokens (classic), not fine-grained personal access tokens. Restrict access via personal access tokens (classic): Personal access tokens (classic) cannot access resources owned by the organization. SSH keys created by personal access tokens (classic) will continue to work.

can, can Restrict access via personal access tokens: Personal access tokens (classic) or fine-grained personal access tokens cannot access resources owned by the organization. SSH keys created by personal access tokens will continue to work. Regardless of the chosen policy, Personal access tokens will have access to public resources within the organization. https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/setting-a-personal-access-token-policy-for-your-organization#restricting-access-by-personal-access-tokens

I read it as correct Classic PAT can still read Public resources SSH Keys created via a PAT can also still access the organization resources

cannot, can "Restrict access via personal access tokens: Personal access tokens (classic) or fine-grained personal access tokens cannot access resources owned by the organization. SSH keys created by personal access tokens will continue to work."

cannot and cannot

Classic PATs cannot access the public resources of the organization. The 'Restrict access via personal access tokens (classic)' option restricts both public and private resource access. SSH keys created by using classic PATs cannot access the resources of the organization. This falls under the same restriction as described above; generated PATs, whether used directly or to create SSH keys, are disallowed.