Study. uk . com
  1. Home
  2. All questions
  3. Question 490

CISSP study material · question 490 of 500

An API accepts serialised objects from untrusted clients. Which condition does OWASP require before that data is used?

  1. Encryption of the serialised data in transit using current transport security.
  2. Validation that the serialised structure matches a published schema.
  3. Rate limiting on the endpoint that receives the serialised data.
  4. An integrity check or digital signature that would detect tampering or replay of the serialised data.
Show the answer

Answer: D. An integrity check or digital signature that would detect tampering or replay of the serialised data.

Serialised data arriving unsigned from a client the server does not trust must first pass a check capable of catching alteration or replay.

Source: OWASP Top 10 A08:2025 (OWASP) — OWASP Top 10:2025 A08 Software or Data Integrity Failures > How to prevent

Challenge yourself on this topic → Study as cards