CCSP Cloud Application Security Practice Question
A cloud application uses a RESTful API that handles payment transactions. The security team identifies that the API is vulnerable to brute-force attacks on the authentication endpoint. Which control should be implemented to mitigate this?
⚠ Common exam trap
ISC2 often tests the distinction between authentication-specific controls (rate limiting) and general security measures (encryption, input validation), leading candidates to choose TLS or API keys because they are commonly associated with API security but do not address brute-force frequency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement rate limiting on the authentication endpoint
Rate limiting restricts the number of authentication requests from a single source within a given time window, directly mitigating brute-force attacks by making it infeasible to guess credentials at high speed. This control is specifically designed for authentication endpoints where repeated failed attempts are the primary attack vector, and it is a standard recommendation in OWASP and NIST guidelines for API security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement rate limiting on the authentication endpoint
Why this is correct
Rate limiting caps the number of authentication attempts from a given source within a time window, throttling the repeated credential guesses that define brute-force attacks. This directly addresses the stem's identified vulnerability on the authentication endpoint.
- ✗
Require API keys for all requests
Why it's wrong here
Static API keys authenticate the caller but are not rate-limited or lockout-capable, so an attacker can still submit unlimited credential guesses against the authentication endpoint. API keys are tempting for authenticating machine clients, yet throttling or account lockout is what actually blunts brute-force attempts.
- ✗
Use TLS to encrypt the communication channel
Why it's wrong here
TLS protects data in transit against interception and tampering, but it does not restrict how many authentication attempts an attacker may submit. It is tempting because encryption is a baseline API control, yet brute-force mitigation requires request throttling or lockout at the authentication endpoint.
- ✗
Add input validation for all parameters
Why it's wrong here
Input validation rejects malformed or malicious parameter values, but a brute-force attack submits well-formed credentials repeatedly, so validation never triggers. It is tempting as a general hardening measure against injection, yet limiting attempt frequency is the control that addresses credential guessing.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.