Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
CancellationTokenSource is easy to create casually, especially for timeouts. This drill checks whether the candidate understands it can own resources and must have a clear lifetime.
CancellationToken is just the signal passed around, but CancellationTokenSource owns the ability to trigger cancellation. If I create a source, especially one with a timeout or linked token, I should dispose it when I am done. Timeout-based sources may use timers. I also avoid creating new sources deep in the stack when the caller already owns cancellation policy.