CCSP Cloud Application Security Practice Question
A global e-commerce platform uses AWS API Gateway to expose REST APIs to third-party developers. The security team notices that a malicious user is repeatedly sending large payloads to a /submit endpoint, causing high CPU usage on backend Lambda functions. The API uses a simple API key for authentication. Which combination of controls should be implemented to mitigate this attack while preserving legitimate access?
⚠ Common exam trap
ISC2 often tests the distinction between network-layer DDoS protection (Shield Advanced) and application-layer controls (throttling, WAF, payload validation), leading candidates to choose Shield Advanced when the attack is clearly at the application layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure API Gateway throttling and request body size validation
It directly addresses the two attack vectors: large payloads causing CPU exhaustion and excessive request volume. API Gateway request body size validation (up to 10 MB by default, configurable) rejects oversized payloads before they reach the backend Lambda, while throttling (e.g., 10,000 requests per second with a burst limit) prevents a single user from overwhelming the system. Together, these controls preserve legitimate access by only limiting anomalous traffic, not blocking all users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure API Gateway throttling and request body size validation
Why this is correct
Throttling limits request rate, and size validation rejects large payloads before reaching Lambda.
- ✗
Subscribe to AWS Shield Advanced for DDoS protection
Why it's wrong here
Shield Advanced is for large DDoS, not for application-level abuse on a single endpoint.
- ✗
Change authentication to IAM roles with temporary credentials
Why it's wrong here
Better auth does not prevent volumetric attacks.
- ✗
Enable AWS WAF with a rate-based rule and block IP addresses
Why it's wrong here
WAF rate-based rules can throttle but do not limit payload size.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.