ln the context of authentication and authorization, scopes refer to the permissions that an application requests from a user. These permissions define the level of access that the application has to the user's data. Option 1 : Can be additionally set when Okta acts as an authorization server is a correct statement. When Okta acts as an authorization server, scopes can be defined as part of the OAuth 20 and OpenID Connect protocols. Scopes can be used to control access to specific resources or data by the client application. Option 2: Do not exist in the scenario when Okta is the authorization server is an incorrect statement. Scopes do exist when Okta is the authorization server, and they are an important part of the authorization process. Option 3: Can be 'openid', 'profile', 'email', 'phone', 'offline_access', and 'address' when Okta is the authorization server is also a correct statement. These are some of the predefined scopes that can be used with the OAuth 20 and OpenID Connect protocols when Okta acts as an authorization server. Option 4: Cannot be additionally set when Okta acts as an authorization server is an incorrect statement, as scopes can be customized and defined by the application developer based on their specific requirements. Therefore, The correct answers is Option: Can be additionally set when Okta acts as an authorization server, and Option 3: Can be 'openid', 'profile', 'email', 'phone', 'offline_access', and 'address' when Okta is the authorization server.