CCSP Cloud Application Security Practice Question
Which THREE of the following are effective controls to secure a RESTful API in the cloud?
⚠ Common exam trap
ISC2 often tests the misconception that CORS is a security control that should be broadly enabled, when in fact it is a relaxation of the same-origin policy and must be tightly scoped to prevent cross-origin attacks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing rate limiting and throttling
Option C is correct because rate limiting and throttling cap the number of requests a client can make in a given time window, mitigating brute-force, credential-stuffing, and denial-of-service abuse against API endpoints. Option D is correct because strong authentication (e.g., OAuth 2.0 tokens, mutual TLS) and authorization (e.g., scopes, RBAC, least privilege) ensure only verified, permitted identities can invoke API operations. Option E is correct because validating and sanitizing all inputs defends against injection flaws such as SQL injection, NoSQL injection, and command injection that arise from untrusted API parameters. Option A is not appropriate because enabling CORS for all domains (wildcard Access-Control-Allow-Origin) exposes the API to cross-origin abuse rather than restricting access to trusted origins. Option B is not appropriate because HTTP Basic authentication over plain HTTP transmits base64-encoded credentials in cleartext, which can be intercepted; it should only be used over TLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enabling CORS (Cross-Origin Resource Sharing) for all domains
Why it's wrong here
Wildcard CORS permits any origin to read responses, so a malicious site can invoke the API with the victim's ambient credentials. CORS is legitimately used to restrict which specific trusted origins a browser may call, but only when scoped to named domains rather than all.
- ✗
Using HTTP basic authentication over plain HTTP
Why it's wrong here
Basic authentication transmits base64-encoded credentials, which are trivially decoded on the wire, so plain HTTP exposes them to interception. Basic auth is acceptable only when tunnelled inside TLS, where the transport encrypts the header in transit.
- ✓
Implementing rate limiting and throttling
Why this is correct
Rate limiting and throttling cap request volume per client or key, mitigating brute-force, credential-stuffing and denial-of-service abuse against REST endpoints. This directly satisfies the stem's requirement for an effective control protecting cloud-hosted APIs from volumetric and enumeration attacks.
- ✓
Enforcing strong authentication and authorization mechanisms
Why this is correct
Strong authentication verifies caller identity while authorisation enforces least-privilege access to each REST resource and method. Together they prevent anonymous or over-privileged API calls, directly meeting the stem's requirement for effective controls securing cloud-hosted RESTful APIs.
- ✓
Validating and sanitizing all inputs to avoid injection attacks
Why this is correct
Input validation and sanitisation strip or neutralise malicious payloads before they reach backend interpreters, directly blocking injection attacks such as SQL, command and XML injection against the API's exposed parameters. This satisfies the stem's requirement for an effective RESTful API security control.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.