An organization enables Enforce Scopes and configures a custom app with oauth:readonly. Which TWO statements are correct about what this app can do? (Choose two...