CAS-003 · Question #621
Joe an application security engineer is performing an audit of an environmental control application. He has implemented a robust SDLC process and is reviewing API calls available to the application…
The correct answer is B. Perform authentication via a secure channel. The log file Joe reviewed during the API audit most likely shows authentication credentials or session tokens being transmitted over an unencrypted or insecure channel (e.g., plain HTTP). The best mitigation is to enforce authentication exclusively over a secure channel such as…
Question
Joe an application security engineer is performing an audit of an environmental control application. He has implemented a robust SDLC process and is reviewing API calls available to the application. During the review, Joe finds the following in a log file. Which of the following would BEST mitigate the issue Joe has found?
Options
- AEnsure the API uses SNMPv1.
- BPerform authentication via a secure channel
- CVerify the API uses HTTP GET instead of POST
- DDeploy a WAF in front of the API and implement rate limiting
How the community answered
(25 responses)- A4% (1)
- B84% (21)
- C8% (2)
- D4% (1)
Explanation
The log file Joe reviewed during the API audit most likely shows authentication credentials or session tokens being transmitted over an unencrypted or insecure channel (e.g., plain HTTP). The best mitigation is to enforce authentication exclusively over a secure channel such as HTTPS/TLS (B), ensuring credentials cannot be intercepted in transit. Option A (SNMPv1) is an outdated, insecure protocol and would worsen security. Option C (HTTP GET instead of POST) is irrelevant to authentication security and can actually expose credentials in URLs/logs. Option D (WAF with rate limiting) adds perimeter protection but does not fix the underlying insecure transmission of credentials.
Topics
Community Discussion
No community discussion yet for this question.