CAS-004 Security Architecture Practice Question
A security analyst is investigating an API that uses JSON Web Tokens (JWT) for authentication. Which field in a JWT contains the token expiration time?
⚠ Common exam trap
The trap is confusing the temporal claims — candidates mix up 'iat' (issued at) with 'exp' (expires), or assume 'nbf' means expiration when it actually means 'not before'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
exp
The 'exp' (expiration time) claim in a JWT is a NumericDate value representing the UTC time after which the token MUST NOT be accepted, as defined in RFC 7519. Validating 'exp' is the standard mechanism for enforcing token lifetime and limiting the window of abuse if a token is stolen.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
exp
Why this is correct
The exp claim is a registered JWT payload field holding the expiration time as a NumericDate, after which the token must be rejected. Validating exp lets the analyst determine whether the token has lapsed, directly answering which field carries the expiration time.
- ✗
iss
Why it's wrong here
The iss claim identifies the token's issuer, used to validate provenance, not expiry. Tempting because both are registered claims in the same payload, but exp is the field carrying the expiration timestamp that the analyst needs.
- ✗
iat
Why it's wrong here
The iat claim records when the token was issued, which supports freshness checks but does not itself define expiry. Tempting because it is a timestamp in the payload, yet exp is the registered claim that specifies when the token stops being valid.
- ✗
sub
Why it's wrong here
The sub claim identifies the principal the token represents, not its lifetime; expiry lives in the exp claim. It is tempting because subject identification is central to authentication, and sub would be the right field when a resource server must map a token to a specific user account.
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.