ITPEC FE Subject B April 2026 Question 20
From the answer group below, select the most appropriate answer to be inserted into blank in the description.
Company S had recently released a photo editing application named Application Y for mobile platforms.
As storage for users to upload the photos they wish to process, Application Y utilizes a cloud storage service. The cloud storage service exposes REST API endpoints that accept requests from REST client. Application Y makes direct REST API calls to the cloud storage service, and the access tokens required to invoke these APIs are embedded directly within the application logic. Figure 1 shows the portion of the Application Y architecture related to access to the cloud storage service. Other components are omitted for simplicity.
Figure 1 Application Y architecture related to access to the backend storage service
A security researcher discovered that the access token embedded in Application Y could be extracted from Application Y. The researcher was able to invoke the REST API directly and access the storage service using the extracted token.
The developer team of Company S proposed the following for architectures to prevent future exposure of storage access tokens.
Architecture One: Use a Secure Vault to manage access tokens.
In this architecture, access tokens are stored in a Secure Vault, which is a digital safe for protecting sensitive data such as API access tokens. When Application Y needs to access the storage service, it retrieves a temporary token from the Secure Vault and uses the token to make REST API calls directly to the cloud storage service over HTTPS.
Figure 2 Architecture One
Architecture Two: Use a VPN to secure communication.
In this architecture, Application Y establishes a VPN connection to the cloud environment. All REST API calls from Application Y to the cloud storage service are transmitted through the VPN. The client application continues to use an access token to invoke the REST APIs of the storage service.
Figure 3 Architecture Two
Architecture Three: Use an API Server.
In this architecture, an API server is introduced between Application Y and the cloud storage service. The API server securely stores the access tokens and performs REST API Calls. Application Y communicates only with the API server over HTTPS and does not possess access tokens for the cloud storage service. All authentication, authorization, and business logic are enforced on the API server, which performs REST API calls to the storage service on behalf of the client.
Figure 4 Architecture Three
Architecture Four: Use a proxy server.
In this architecture, a proxy server is deployed between Application Y and the cloud storage service. The proxy server stores the access credentials required to access the storage service. Application Y sends REST API requests to the proxy server over HTTPS, and the proxy server forwards these requests to the cloud storage service using the stored credentials. The proxy server does not perform application-specific authentication, authorization, or business logic enforcement, and simply relays REST API requests from the client to the storage service.
Figure 5 Architecture Four
By comparing them, the security team of Company S suggested the application development team redesign the application architecture to Architecture blank .
Answer group
Explanation
Architecture Three — the only design in which Application Y holds no storage token and a server decides which requests are allowed.
The flaw was that the token sat inside Application Y and could be extracted from it. A fix must therefore keep every storage credential off the client. In Architecture Three the API server stores the tokens and enforces authentication, authorization and business logic, then calls the storage service on the client's behalf. Application Y talks only to the API server and has no storage token to extract, and a stolen user session reaches only what the API server permits.
Answer (c)
Why not others:
- •(a) One — the Secure Vault hands a temporary token to Application Y, which then calls the storage service directly; the token still reaches the client and can be extracted, only for a shorter time
- •(b) Two — a VPN protects the traffic in transit, but the token still sits in Application Y (the starred location in Figure 3); the researcher took it from the application, not from the network
- •(d) Four — the proxy holds the credentials, but it does no authentication, authorization or business logic and relays any request, so anyone who can reach the proxy can use the storage service through it
Key rule: Keep secrets on a server the client cannot inspect, and make that server enforce who may do what; moving a secret to a relay that checks nothing just moves the hole.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.