Examkin

Question

Difficulty: HardIdentity and Access Management Architecture

A security architect is designing an identity and access management (IAM) infrastructure for an enterprise microservices environment. The organization requires that OAuth 2.0 access tokens issued to client applications are sender-constrained, ensuring that if a token is intercepted in transit, it cannot be replayed by an unauthorized third party to access downstream APIs. Which of the following architectural solutions best satisfies this security requirement?

  1. Implement Demonstration of Proof-of-Possession (DPoP) to cryptographically bind access tokens to a client-generated key pair.Answer
  2. B
    Deploy a Web Application Firewall (WAF) at the network perimeter to inspect and validate JWT signature headers on incoming requests.
  3. C
    Configure System for Cross-domain Identity Management (SCIM) endpoints to enforce automated authorization policy checks.
  4. D
    Enforce Role-Based Access Control (RBAC) scopes within the SAML 2.0 HTTP POST binding payload across all API calls.

Answer

Demonstration of Proof-of-Possession (DPoP) cryptographically binds access tokens to a client-generated key pair to prevent token replay attacks.
Demonstration of Proof-of-Possession (DPoP) is an extension to OAuth 2.0 that binds access tokens to a specific cryptographic key pair owned by the client. When making API requests, the client must generate and sign a fresh DPoP proof header using its private key. Because an attacker intercepting the token lacks the corresponding private key, they cannot generate a valid signature, effectively neutralizing token replay attacks.

Step-by-Step Solution

1
Analyze the architectural requirement.
The scenario requires sender-constraining OAuth 2.0 access tokens so that stolen or intercepted tokens cannot be reused by an adversary (preventing bearer token replay).
Standard bearer tokens can be used by any party holding them, making sender-binding essential for Zero Trust API security architectures.
2
Evaluate potential cryptographic token binding mechanisms.
Demonstration of Proof-of-Possession (DPoP) forces the client to present a unique signed DPoP proof header containing a public key matched to the issued token.
This binds the access token explicitly to the client's private key, rendering intercepted tokens useless to an attacker without access to that private key.
3
Differentiate from incorrect IAM standards and perimeter controls.
SCIM manages user account provisioning, SAML POST handles web browser single sign-on, and perimeter WAFs rely on network edge inspection rather than end-to-end client-bound token proofs.
None of these alternatives provide cryptographic sender-constraining of API access tokens.

Key Concept

OAuth 2.0 Token Binding and Sender-Constrained Tokens (DPoP)
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic