mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Is designing an API that handles sensitive…
A security engineer is designing an API that handles sensitive customer data. The engineer wants to ensure that only authorized clients can access the API, and that requests are not tampered with in transit. Which approach best addresses both requirements?
⚠ Common exam trap
Many exam-takers assume TLS alone is sufficient for API security, overlooking that TLS provides transport-layer security but does not enforce application-layer authorization, which is a separate requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing OAuth 2.0 with Bearer tokens over HTTPS
OAuth 2.0 with Bearer tokens over HTTPS combines a token-based authorization framework with TLS encryption. HTTPS (TLS) ensures confidentiality and integrity of data in transit, preventing tampering, while OAuth 2.0 provides a standardized mechanism for issuing and validating access tokens, ensuring only authorized clients with valid tokens can access the API. This dual approach directly addresses both authorization and integrity requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enforcing TLS for all communications
Why it's wrong here
Enforcing TLS (Transport Layer Security) for all communications primarily establishes a secure, encrypted channel between the client and the API, ensuring confidentiality and integrity of data in transit, and authenticating the server. While crucial for protecting sensitive data from eavesdropping and tampering, TLS alone does not provide a mechanism for *authorization*—it doesn't determine *which* specific clients or users are permitted to access *what* specific resources or perform *which* actions within the API.
- ✗
Requiring a digital signature using HMAC on each request
Why it's wrong here
Requiring a digital signature using HMAC (Hash-based Message Authentication Code) on each request ensures message integrity and authenticity, verifying that the request has not been altered and originated from a party possessing the shared secret key. While HMAC can authenticate the *source* of a request and prevent tampering, it does not inherently offer a framework for *delegated authorization* or managing fine-grained access control based on user roles or permissions for specific API operations.
- ✓
Implementing OAuth 2.0 with Bearer tokens over HTTPS
Why this is correct
Implementing OAuth 2.0 with Bearer tokens over HTTPS provides a robust solution for delegated authorization, allowing a third-party application to access protected resources on behalf of a user without exposing the user's credentials. OAuth 2.0 defines the authorization flow, while Bearer tokens serve as the credentials presented by the client to access resources. HTTPS is essential to protect the confidentiality and integrity of these tokens and the sensitive data exchanged, preventing interception and ensuring secure communication.
- ✗
Using API keys transmitted in the request header
Why it's wrong here
Using API keys transmitted in the request header primarily serves to authenticate the calling application and can be used for rate limiting or identifying the client. However, API keys alone do not provide a comprehensive authorization framework for managing user-specific permissions or delegated access. Furthermore, if not combined with HTTPS, API keys are vulnerable to interception and replay attacks, and the request content itself is susceptible to tampering, compromising both authentication and data integrity.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.