CCSP Cloud Application Security Practice Question
Which TWO practices help protect against insecure deserialization attacks in cloud applications?
⚠ Common exam trap
ISC2 often tests the misconception that encryption alone (Option B) is sufficient to secure serialized data, but encryption only protects data at rest or in transit, not the deserialization process itself, which is where the attack occurs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Validate serialized objects before deserialization
Validating serialized objects before deserialization ensures that the data conforms to expected schemas and constraints, preventing malicious payloads from triggering arbitrary code execution. This practice is critical in cloud applications where deserialization of user-supplied data (e.g., JSON or XML) can lead to remote code execution (RCE) or denial-of-service (DoS) attacks if not validated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow deserialization from untrusted sources
Why it's wrong here
Untrusted sources increase risk of malicious payloads.
- ✗
Use strong encryption for all serialized data
Why it's wrong here
Encryption protects confidentiality, not integrity of deserialization.
- ✗
Implement custom deserialization without validation
Why it's wrong here
Custom deserialization without validation is prone to attacks.
- ✓
Validate serialized objects before deserialization
Why this is correct
Validation can detect tampered objects.
- ✓
Restrict deserialization to a whitelist of classes
Why this is correct
Whitelisting prevents deserialization of unexpected classes.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.