Cloud Application Security →mediumMultiple ChoiceObjective-mapped

CCSP Cloud Application Security Practice Question

Exhibit

Error: Exception in thread "main" java.lang.SecurityException: Unauthorized access
    at com.cloudapp.auth.TokenValidator.validate(SourceFile:112)
    at com.cloudapp.api.ApiGateway.handleRequest(SourceFile:45)
Caused by: com.cloudapp.auth.InvalidTokenException: Token expired at 2024-11-20T10:30:00Z
    at com.cloudapp.auth.JwtParser.parse(SourceFile:78)

Refer to the exhibit. A developer reports that users are being denied access to a cloud application. The error log shows the above. What is the most likely cause of the denial?

⚠ Common exam trap

ISC2 often tests the distinction between token validation steps (signature, issuer, expiration, permissions) and the specific error messages each step produces, so candidates must match the error log text to the correct validation failure rather than assuming a generic 'access denied' reason.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The token's expiration time has passed

The error log indicates that the token's expiration time has passed, which is a standard validation check in OAuth 2.0 and OpenID Connect (OIDC) flows. When a token's `exp` claim is less than the current server time, the authorization server or resource server rejects the request with an 'access denied' or similar error. This is the most direct cause of the denial shown in the exhibit.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The token was issued by an untrusted issuer
Why it's wrong here
The error does not mention issuer trust; it specifically says token expired.
✗
The token lacks required permissions
Why it's wrong here
Lack of permissions would result in a different error, not a token expiration error.
✓
The token's expiration time has passed
Why this is correct
The log explicitly states 'Token expired at 2024-11-20T10:30:00Z', indicating expiration.
✗
The token's signature is invalid
Why it's wrong here
Signature validation would produce a different error; the log shows 'InvalidTokenException: Token expired'.

Go deeper

CCSP Cloud Application Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question