,"text":"Data residency compliance","isCorrect":false},{"id":"55b79871-2de4-4458-991e-6d58c0321ba9","label":null,"text":"Cost optimization of cloud resources","isCorrect":false},{"id":"0c2ab016-0d39-4059-9879-872a311b399a","label":null,"text":"Security controls of the cloud service provider","isCorrect":true},{"id":"4af9f76d-2d9c-444c-9b57-70fab488cbf7","label":null,"text":"Performance SLA","isCorrect":false}],"domainName":"Security Architecture","domainSlug":"casp-security-architecture"},{"id":"808f0083-e903-4022-a252-8726014d9c80","slug":"a-security-analyst-reviews-this-configuration-and-identifies-wr7fq","questionText":"A security analyst reviews this configuration and identifies a vulnerability. What is the MOST critical issue?","explanation":"The redirect URI using HTTP (not HTTPS) is the most critical issue because it allows an attacker to intercept the authorization code during the OAuth 2.0 flow. If the redirect URI is transmitted over cleartext HTTP, an attacker on the same network can capture the authorization code via man-in-the-middle (MITM) attacks and exchange it for an access token, leading to account takeover. This violates the OAuth 2.0 security best practice (RFC 6819) that mandates the use of TLS for all redirect URIs.","domainId":null,"difficulty":"easy","questionType":"multiple_choice","pbqConfig":null,"exhibitText":"Refer to the exhibit.\n\n\n \n abc123\n secret!\n https://auth.example.com/token\n http://app.example.com/callback\n authorization_code\n \n","options":[{"id":"c975dd39-fcd7-4789-aa01-66f1e171cc73","label":null,"text":"The grant type is authorization_code","isCorrect":false},{"id":"fc9c132f-438a-44e4-90fc-1c1e492de00e","label":null,"text":"The client secret is hardcoded","isCorrect":false},{"id":"6eb60a53-e282-42fd-8565-530ff87da3d4","label":null,"text":"The redirect URI uses HTTP","isCorrect":true},{"id":"4eab33df-1a34-41ab-bf8b-97113a9f4af3","label":null,"text":"The token endpoint uses HTTPS","isCorrect":false}],"domainName":null,"domainSlug":null},{"id":"9d7ed6a5-0d68-4d89-9b6a-4fafc62a1323","slug":"a-company-is-developing-a-new-mobile-app-that-will-process-u-ala7o","questionText":"A company is developing a new mobile app that will process users' biometric data for authentication. The legal team is concerned about compliance with the GDPR's data protection by design. Which of the following is the MOST appropriate control to implement?","explanation":"Conducting a Data Protection Impact Assessment (DPIA) before development is the most appropriate control because GDPR Article 35 mandates a DPIA when processing biometric data is likely to result in high risk to individuals' rights and freedoms. This aligns with the principle of data protection by design (Article 25), requiring privacy considerations to be embedded into the development process from the outset, not added later.","domainId":null,"difficulty":"easy","questionType":"multiple_choice","pbqConfig":null,"exhibitText":null,"options":[{"id":"7be068a8-9e74-40cb-9ad4-0888fd3294b9","label":null,"text":"Obtain explicit consent from users before data collection.","isCorrect":false},{"id":"0eff6eda-3112-413d-80d7-d38fdcc97b9b","label":null,"text":"Store biometric data in hashed form on the device.","isCorrect":false},{"id":"2bd607cb-5348-4d92-88df-f54e0444adb4","label":null,"text":"Implement strong encryption for data in transit and at rest.","isCorrect":false},{"id":"0012a4fb-3887-4099-9de7-94ebcc76d6d4","label":null,"text":"Conduct a Data Protection Impact Assessment (DPIA) before development.","isCorrect":true}],"domainName":null,"domainSlug":null},{"id":"58353c07-960d-4a7b-944e-b472f591389b","slug":"a-security-team-is-conducting-a-penetration-test-against-a-c-kc0vv","questionText":"A security team is conducting a penetration test against a client's web application. During the reconnaissance phase, the tester d