CAS-004 Security Architecture Practice Question
A security architect is evaluating an API security strategy for a SaaS application that supports OAuth 2.0. Which TWO controls should the architect recommend to protect against token interception and replay attacks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforcing short-lived access tokens with refresh token rotation
Using short-lived access tokens reduces the window of opportunity for replay attacks. Token binding (proof-of-possession) ties the token to the client, making interception less useful. Rate limiting mitigates brute force but not token interception. Long-lived tokens increase risk. JWT encryption protects content but not replay.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using long-lived access tokens to reduce authentication frequency
Why it's wrong here
Long-lived tokens increase the risk of interception and replay; short-lived tokens are recommended.
- ✓
Enforcing short-lived access tokens with refresh token rotation
Why this is correct
Short-lived tokens limit the time window for misuse, and rotating refresh tokens adds security.
- ✗
Encrypting JWT payloads with a symmetric key
Why it's wrong here
Encrypting the payload protects confidentiality but does not prevent replay attacks.
- ✓
Implementing token binding to bind tokens to a specific client session
Why this is correct
Token binding ensures the token is only valid when presented by the same client that obtained it, preventing replay.
- ✗
Implementing rate limiting on the token endpoint
Why it's wrong here
Rate limiting prevents brute force attacks on the token endpoint but does not protect against token interception or replay.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.