CAS-004 Security Architecture Practice Question
During a threat modeling exercise for a new web application, the team identifies a risk of API abuse due to lack of rate limiting. Which security control should be implemented at the API gateway to mitigate this risk?
⚠ Common exam trap
CAS-005 often tests the confusion between authentication/authorisation controls (OAuth scopes, JWT expiration) and availability/abuse controls (rate limiting) — candidates must match the control to the specific risk of API abuse via excessive requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rate limiting policies
Rate limiting policies are the direct control to mitigate API abuse by restricting the number of requests a client can make within a time window. Implemented at the API gateway, they prevent denial-of-service, brute-force, and excessive consumption of backend resources. While other controls like input validation or OAuth scopes address different threats, rate limiting specifically targets the risk of API abuse due to lack of throttling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Input validation
Why it's wrong here
Input validation rejects malformed payloads but does nothing to cap request frequency, so a flood of well-formed calls still exhausts the API. It belongs where injection or schema abuse is the threat, not volumetric abuse.
- ✗
OAuth 2.0 scopes
Why it's wrong here
OAuth 2.0 scopes constrain which resources a token may access, not how many requests it may issue; a valid token can still hammer the API. Scopes suit authorisation granularity, whereas throttling per client is the rate-limiting control.
- ✓
Rate limiting policies
Why this is correct
Rate limiting policies at the API gateway cap the number of requests a client may make within a defined window, throttling or blocking excessive calls. This directly mitigates the identified API abuse risk arising from absent rate limiting.
- ✗
JWT token expiration
Why it's wrong here
JWT expiration limits how long a token remains valid, but a short-lived token can still be replayed thousands of times within its lifetime. Expiry addresses credential longevity, not request volume; rate limiting caps calls per interval.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.