ITPEC FE Subject B April 2026 Question 20

Architecture Three — the only design in which the client holds no access token at all.

The flaw was that the token lived inside Application Y and could be extracted from it, so any fix must move the credential off the client entirely. The API server does exactly that: it stores the credentials, enforces authentication, authorization and business logic, and calls the storage service on the client's behalf. Application Y talks only to the API server and has nothing worth extracting.

Answer (c)

Why not others:
- (a) One — the Secure Vault issues a temporary token, but that token still reaches the application and is used from there, so it remains extractable; the exposure window shrinks rather than closing
- (b) Two — a VPN protects traffic in transit, yet the note still places the token inside Application Y; the researcher extracted it from the application, not from the network
- (d) Four — the proxy does hold the credentials, which is an improvement, but it performs no application-specific authentication, authorization or business logic, so it forwards whatever request reaches it; anyone able to reach the proxy inherits its access

Key rule: Ask two questions of each design — where the secret ends up, and who decides whether a request is permitted. Moving the secret to a server helps only if that server also enforces the rules.

AI-generated — may contain errors