This CCSP practice question tests your understanding of cloud application security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE of the following are effective controls to secure a RESTful API in the cloud?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing rate limiting and throttling
Rate limiting and throttling are effective controls for RESTful APIs because they prevent abuse by limiting the number of requests a client can make within a specified time window, mitigating denial-of-service (DoS) attacks and brute-force attempts. In cloud environments, these controls are often implemented at the API gateway or load balancer level using token bucket or leaky bucket algorithms, ensuring fair resource usage and protecting backend services from overload.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Enabling CORS (Cross-Origin Resource Sharing) for all domains
Why it's wrong here
CORS is a browser policy; it does not protect the API from attackers who can craft requests.
✗
Using HTTP basic authentication over plain HTTP
Why it's wrong here
No encryption exposes credentials in transit.
✓
Implementing rate limiting and throttling
Why this is correct
Prevents DoS and brute-force attacks.
Related concept
Read the scenario before looking for a memorised answer.
✓
Enforcing strong authentication and authorization mechanisms
Why this is correct
Essential for access control.
Related concept
Read the scenario before looking for a memorised answer.
✓
Validating and sanitizing all inputs to avoid injection attacks
Why this is correct
Prevents command injection, XSS, etc.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the misconception that CORS is a security control that should be broadly enabled, when in fact it is a relaxation of the same-origin policy and must be tightly scoped to prevent cross-origin attacks.
Detailed technical explanation
How to think about this question
Rate limiting typically uses algorithms like the token bucket (where tokens are added at a fixed rate) or sliding window log (which tracks timestamps of requests) to enforce limits per client IP or API key. In cloud-native architectures, services like AWS API Gateway or Azure API Management allow configuring rate limits at the API stage or method level, and they can return HTTP 429 (Too Many Requests) with a Retry-After header to inform clients. A subtle behavior is that distributed rate limiting across multiple API gateway instances requires a shared state (e.g., Redis) to avoid exceeding limits due to clock skew or inconsistent counters.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Cloud Application Security — This question tests Cloud Application Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Implementing rate limiting and throttling — Rate limiting and throttling are effective controls for RESTful APIs because they prevent abuse by limiting the number of requests a client can make within a specified time window, mitigating denial-of-service (DoS) attacks and brute-force attempts. In cloud environments, these controls are often implemented at the API gateway or load balancer level using token bucket or leaky bucket algorithms, ensuring fair resource usage and protecting backend services from overload.
What should I do if I get this CCSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.