Exam CAS-004 topic 1 question 163 discussion

Its B, you can't brute force a page with no authentication lol Key words: experiencing a slowdown on the unauthenticated payments page

Its is C. even having the payment page as unauthenticated is receiving brute force attack and the inline WAF in blocking mode caused DoS.

The application programming interface (API) is experiencing issues as it is being directly targeted. I overlooked this at first and looking at the question and the answer: "the bank is experiencing a slowdown on the unauthenticated payments page" which is a directly specific interface. This mean that the API itself is being targeted

brute-force is not possible where the is no-authentication, so the only possible answer is B

thinking B here

C. The site is experiencing a brute-force credential attack. Brute force attacks typically target login or authentication systems. While this type of attack can cause a slowdown, the slowdown would typically be observed on the login or authentication pages, not on the unauthenticated payments page. B. The API gateway endpoints are being directly targeted. This is a plausible cause. If the API gateway endpoints responsible for the unauthenticated payments page are being targeted, it could cause a slowdown on that specific page.

Going with B. If the API's are slowed, performance issues will follow. Source: Verifying each answer against Chat GPT, my experience, other test banks, a written book, and weighing in the discussion from all users to create a 100% accurate guide for myself before I take the exam. (It isn't easy because of the time needed, but it is doing my diligence)

Going with C....WAFs can protect the API gateway.

the MOST likely cause of the slowdown on the unauthenticated payments page is option B, the API gateway endpoints being directly targeted. This could cause increased traffic and load on the backend systems responsible for handling payment requests, resulting in a slowdown for users accessing the unauthenticated payments page.

Why not C? A brute-force attack is a type of attack that involves trying to guess a password or other type of authentication credential by trying a large number of possible combinations. If the unauthenticated payments page is experiencing a slowdown, it could be because the site is being targeted by a brute-force attack, in which an attacker is trying to guess the credentials for the page. It is not likely that the public cloud provider is applying QoS (Quality of Service) to the inbound customer traffic (option A), as QoS is typically used to prioritize traffic rather than causing a slowdown. It is also not likely that the API gateway endpoints are being directly targeted (option B), as this would typically result in errors rather than a slowdown. It is also not likely that a DDoS (Distributed Denial of Service) attack is targeted at the CDN (option D), as the WAF (Web Application Firewall) should be able to block such an attack.

A is correct