mediumMultiple Choice
CCSP A cloud-native application is deployed on AWS Practice Question
A cloud-native application is deployed on AWS. During a security review, the team discovers that if an attacker can send a crafted request to the application, the application will make an HTTP request to http://169.254.169.254/latest/meta-data/iam/security-credentials/. Which vulnerability is being exploited?
⚠ Common exam trap
CCSP often tests whether candidates can distinguish SSRF from other injection attacks, especially when cloud metadata endpoints are involved.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-Side Request Forgery (SSRF)
The vulnerability is Server-Side Request Forgery (SSRF). The attacker crafts a request that causes the application to make an HTTP request to the EC2 instance metadata service at 169.254.169.254, potentially retrieving IAM credentials. This is a classic SSRF attack targeting cloud metadata endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection
Why it's wrong here
SQL injection manipulates database queries through unsanitised input; it does not cause the application to fetch credentials from the link-local metadata address. It is tempting because injection flaws are frequently tested in cloud reviews, but it would be the answer where crafted input alters a backend SQL statement.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
XSS involves injecting client-side scripts, not server-side requests to metadata.
- ✗
Insecure deserialization
Why it's wrong here
Insecure deserialization exploits untrusted serialised data to execute code or manipulate objects during reconstruction, and involves no HTTP request to a metadata endpoint. It is tempting because it is a recognised OWASP cloud risk, but it would be the answer where attacker-supplied serialised payloads are processed by the application.
- ✓
Server-Side Request Forgery (SSRF)
Why this is correct
The application fetches the instance metadata endpoint on the attacker's behalf, returning temporary IAM credentials. SSRF occurs because user-supplied input controls the server-side request target, letting the attacker reach the link-local address that external clients cannot access directly.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.