CCSP Cloud Application Security Practice Question
A large enterprise is migrating a legacy .NET application to Azure App Service. The application currently stores session state in-memory on the web server. During the migration, the team plans to horizontally scale the application across multiple instances. The security team requires that session data remain confidential and be available even if an instance fails. Which solution should the team implement?
⚠ Common exam trap
ISC2 often tests the distinction between availability and affinity, where candidates mistakenly choose sticky sessions (Option D) thinking they solve availability, but sticky sessions actually create a single point of failure by binding a user to one instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Redis Cache to store session state with encryption enabled
Azure Redis Cache with encryption enabled provides a secure, centralized session store that persists data independently of individual web server instances. This ensures session data remains available even if an instance fails, and encryption protects confidentiality in transit and at rest, meeting the security team's requirements for horizontal scaling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store session data in Azure SQL Database with column-level encryption
Why it's wrong here
SQL Database works but is heavier; Redis is purpose-built for cache/session.
- ✓
Use Azure Redis Cache to store session state with encryption enabled
Why this is correct
Redis provides scalable, encrypted, persistent session storage independent of instances.
- ✗
Encrypt session data and store it as a client-side cookie
Why it's wrong here
Client-side cookies can be tampered with and have size limits.
- ✗
Configure Application Gateway with cookie-based affinity (sticky sessions)
Why it's wrong here
Sticky sessions tie users to specific instances; if the instance fails, session is lost.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.