CCSP Cloud Application Security Practice Question
A security analyst is reviewing application logs and notices that a large number of requests from a single IP address are attempting to access a REST API endpoint with invalid session tokens. Which cloud-based mitigation is MOST effective at blocking such automated attacks?
⚠ Common exam trap
Watch out — candidates often confuse session token management (e.g., rotation, encryption) with the need for a perimeter defense that controls request volume and source, leading them to pick options that address token validity rather than the automated, high-volume nature of the attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a web application firewall (WAF) with rate limiting and IP blacklisting
A Web Application Firewall (WAF) with rate limiting and IP blacklisting directly addresses the described attack: a single IP flooding a REST API with invalid session tokens. Rate limiting throttles the number of requests from that IP, while IP blacklisting blocks it entirely, preventing automated brute-force or credential-stuffing attempts at the cloud edge before they reach the application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rotate API keys more frequently
Why it's wrong here
API keys do not prevent automated attacks; they can be stolen or reused.
- ✗
Implement cross-origin resource sharing (CORS) policies
Why it's wrong here
CORS affects browser-based requests, not server-side automated tools.
- ✓
Configure a web application firewall (WAF) with rate limiting and IP blacklisting
Why this is correct
WAF can detect and block malicious traffic patterns.
- ✗
Require encryption of session tokens
Why it's wrong here
Encryption does not address the validity of tokens; invalid tokens still cause errors.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.