Which HTTP status code indicates that the server understands the request but refuses to authorize it, and the client should not repeat the request without changing the request itself?

Why C is correct

403 Forbidden means the server understood the request but authorization is definitively refused - unlike 401, which implies the request can be retried with valid credentials. A 403 means even with authentication, this resource is off-limits (wrong role, IP restriction, etc.). Servers sometimes return 404 instead of 403 to avoid disclosing the existence of restricted resources (security by obscurity). 401 requires a WWW-Authenticate header indicating how to authenticate.