CCSP Cloud Application Security Practice Question
A company runs a multi-tier cloud application with a web frontend, an API layer, and a database. The application uses OAuth 2.0 for authentication. Recently, users have been experiencing session hijacking attacks. Upon investigation, the security team finds that session tokens are being intercepted in transit. The application uses HTTPS for all communications, but a developer discovers that the application is also accessible via HTTP due to a misconfiguration. The team wants to implement additional security controls to prevent token theft. Which course of action should be taken first?
⚠ Common exam trap
ISC2 often tests the concept that session hijacking prevention must address the root cause (insecure transport) rather than just mitigating the impact of token theft, leading candidates to choose options like shortening expiration or IP binding instead of enforcing HTTPS with HSTS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement HTTP Strict Transport Security (HSTS) to enforce HTTPS connections
The root cause is that the application is accessible via HTTP due to a misconfiguration, allowing session tokens to be intercepted in transit despite HTTPS being available. Implementing HTTP Strict Transport Security (HSTS) forces the browser to always use HTTPS, preventing any HTTP connections and thus eliminating the interception vector. This directly addresses the misconfiguration before other controls, which would only mitigate but not prevent the theft.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use IP address binding for session tokens
Why it's wrong here
IP address binding does not stop interception when the attacker shares or spoofs the victim's address, and the plaintext HTTP path still exposes tokens. It suits hardening sessions on trusted fixed networks, not remediating an active cleartext transport misconfiguration.
- ✓
Implement HTTP Strict Transport Security (HSTS) to enforce HTTPS connections
Why this is correct
HSTS forces browsers to use HTTPS exclusively for the domain, eliminating the HTTP misconfiguration that exposes tokens to interception. Addressing the transport downgrade first satisfies the requirement to prevent token theft, since encrypted delivery removes the interception vector.
- ✗
Switch from OAuth to SAML for authentication
Why it's wrong here
Swapping OAuth for SAML changes the token format and flow but leaves the HTTP listener exposing whatever credential is transmitted, so interception continues. SAML is correct for browser SSO federation, not for closing a cleartext transport gap in an API authorisation flow.
- ✗
Shorten the session token expiration time
Why it's wrong here
Shortening token lifetime narrows the window an attacker can replay a stolen token but does not prevent interception over the still-open HTTP endpoint. Short expiry suits limiting damage from token leakage in otherwise-secure transport, not remediating a cleartext channel.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.