easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security analyst reviews this configuration and…
Exhibit
Refer to the exhibit.
<security>
<authentication type="OAuth2">
<client-id>abc123</client-id>
<client-secret>secret!</client-secret>
<token-endpoint>https://auth.example.com/token</token-endpoint>
<redirect-uri>http://app.example.com/callback</redirect-uri>
<grant-type>authorization_code</grant-type>
</authentication>
</security>A security analyst reviews this configuration and identifies a vulnerability. What is the MOST critical issue?
⚠ Common exam trap
CompTIA often tests the misconception that hardcoded secrets (Option B) are always the most critical vulnerability, but in OAuth flows, an insecure redirect URI over HTTP is a more direct and exploitable attack vector that can lead to immediate token theft.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The redirect URI uses HTTP
The redirect URI using HTTP (not HTTPS) is the most critical issue because it allows an attacker to intercept the authorization code during the OAuth 2.0 flow. If the redirect URI is transmitted over cleartext HTTP, an attacker on the same network can capture the authorization code via man-in-the-middle (MITM) attacks and exchange it for an access token, leading to account takeover. This violates the OAuth 2.0 security best practice (RFC 6819) that mandates the use of TLS for all redirect URIs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The grant type is authorization_code
Why it's wrong here
Authorization code is the standard secure grant type for server-side apps.
- ✗
The client secret is hardcoded
Why it's wrong here
Hardcoded secrets are a concern but can be externally managed; the redirect URI is a more immediate risk.
- ✓
The redirect URI uses HTTP
Why this is correct
HTTP transmits the authorization code in plaintext, making it vulnerable to interception.
- ✗
The token endpoint uses HTTPS
Why it's wrong here
HTTPS for token endpoint is correct and secure.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.