hardMultiple SelectObjective-mapped
CAS-004 Practice Question: Which three measures should be implemented to…
Which three measures should be implemented to secure a RESTful API? (Select THREE.)
⚠ Common exam trap
CASP+ often tests the misconception that disabling rate limiting improves availability, when in fact it destroys availability by removing protection against resource exhaustion attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement proper error handling that does not expose stack traces
Proper error handling in a RESTful API must never expose stack traces or internal implementation details to the client. Stack traces can reveal file paths, database schemas, library versions, and logic flows that attackers can exploit to craft targeted attacks. Instead, the API should return generic error messages (e.g., '500 Internal Server Error') while logging full details server-side for debugging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use JSONP for cross-origin requests
Why it's wrong here
JSONP has security risks (e.g., callback injection); use CORS with tokens.
- ✓
Implement proper error handling that does not expose stack traces
Why this is correct
Generic error messages prevent information leakage.
- ✗
Disable rate limiting to ensure availability
Why it's wrong here
Rate limiting prevents abuse; disabling it reduces security.
- ✓
Validate all input against a strict schema
Why this is correct
Input validation prevents injection attacks.
- ✓
Use OAuth2 with scopes for authorization
Why this is correct
OAuth2 provides delegated access with limited scopes.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.