CCSP Cloud Application Security Practice Question
Which THREE of the following are effective controls to secure a RESTful API in the cloud?
⚠ Common exam trap
ISC2 often tests the misconception that CORS is a security control that should be broadly enabled, when in fact it is a relaxation of the same-origin policy and must be tightly scoped to prevent cross-origin attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing rate limiting and throttling
Rate limiting and throttling are effective controls for RESTful APIs because they prevent abuse by limiting the number of requests a client can make within a specified time window, mitigating denial-of-service (DoS) attacks and brute-force attempts. In cloud environments, these controls are often implemented at the API gateway or load balancer level using token bucket or leaky bucket algorithms, ensuring fair resource usage and protecting backend services from overload.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enabling CORS (Cross-Origin Resource Sharing) for all domains
Why it's wrong here
CORS is a browser policy; it does not protect the API from attackers who can craft requests.
- ✗
Using HTTP basic authentication over plain HTTP
Why it's wrong here
No encryption exposes credentials in transit.
- ✓
Implementing rate limiting and throttling
Why this is correct
Prevents DoS and brute-force attacks.
- ✓
Enforcing strong authentication and authorization mechanisms
Why this is correct
Essential for access control.
- ✓
Validating and sanitizing all inputs to avoid injection attacks
Why this is correct
Prevents command injection, XSS, etc.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.