CCSP Cloud Application Security Practice Question
A cloud security engineer is reviewing the authentication mechanism for a web application. The application currently uses API keys transmitted in the URL query string. What is the primary security concern with this approach?
⚠ Common exam trap
ISC2 often tests the misconception that HTTPS fully protects the URL from all exposure, but the trap here is that while HTTPS encrypts data in transit, it does not prevent logging, caching, or referrer leakage of the URL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
API keys in URLs are often logged in plaintext in server logs and browser history.
The primary security concern with transmitting API keys in URL query strings is that URLs are frequently logged in plaintext by web servers, proxies, and browsers. This means the API key can be inadvertently exposed in server access logs, browser history, and referrer headers, making it accessible to anyone with access to those logs. Even with HTTPS encrypting the data in transit, the URL itself is often logged before decryption or after encryption at the termination point, so the key remains visible in log files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
API keys in URLs are often logged in plaintext in server logs and browser history.
Why this is correct
Logging exposes the key to anyone with log access.
- ✗
API keys in query strings are not encrypted, even with HTTPS.
Why it's wrong here
HTTPS encrypts the entire request, but URL can appear in logs before encryption is applied.
- ✗
API keys provide weak authentication because they are not tied to a user session.
Why it's wrong here
The main issue is exposure, not strength.
- ✗
API keys are not valid for use in query strings; they require a certificate.
Why it's wrong here
They can be used in query strings, but it's insecure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.