Study. uk . com
  1. Home
  2. All questions
  3. Question 75

CISSP study material · question 75 of 500

A retail platform authenticates users with stateless JSON Web Tokens (JWTs) that live twelve hours. After an account takeover, support uses "log out all devices" and the attacker's token keeps working until it expires. The team must make logout effective while still letting ordinary customer sessions last a long time. Which design meets both goals?

  1. Encrypt the token payload so that only the issuing server can read the claims on each request.
  2. Issue a short-lived access token and renew it through an OAuth refresh token that the server can revoke.
  3. Sign the token with a stronger algorithm and bind a device fingerprint into the claims it carries.
  4. Keep the twelve-hour token and have the client delete it from browser storage when the user logs out.
Show the answer

Answer: B. Issue a short-lived access token and renew it through an OAuth refresh token that the server can revoke.

Server-held session state can be destroyed at logout; a stateless token stays valid until it expires, so shorten its life and revoke the refresh token. Clearing client storage stops nothing.

Source: OWASP Top 10 A01:2025 (OWASP) — A01:2025 Broken Access Control > How to prevent

Challenge yourself on this topic → Study as cards