WAF, API Gateway, DAM, CASB: What Each Cloud Application Component Can See, and the IAM Stack CCSP Tests
Chris Rees
25+ years in IT · Pluralsight author, 4.6/5 across 2,000+ ratings
A monolith has one trust boundary. Break it into forty-one microservices and it has ninety-three, every one a network call that used to be a function call. CCSP objectives 4.6 and 4.7 are about what sits on those boundaries: the components that inspect traffic, the cryptography and sandboxes that contain it, and the identity stack that decides who crosses. The exam trap is the impressive name. A WAF sounds like it protects the application, a gateway sounds like it authorizes, MFA sounds like it stops phishing. Each is true only within a limit, and the question is written to find it.
Placement: ask what the component can see
Ask what the component sees, and what it therefore cannot do. The outline names five.
| Component | What it inspects | What it cannot do |
|---|---|---|
| Web application firewall (WAF) | HTTP requests and responses: injection strings, XSS payloads, path traversal, bots | see business-logic abuse; novel encodings pass |
| Load balancer | connections; distributes load and commonly terminates TLS | protect the plaintext at that point; re-encrypt behind it |
| API gateway | API calls: token validation, rate limits, schema validation, routing | object-level authorization; only the service knows who owns a record |
| XML firewall | XML and SOAP schema, size and nesting limits, external entities, entity expansion | anything that is not XML |
| Database activity monitoring (DAM) | database queries independently of the application, including direct administrator connections | see application context; blind where a managed database offers no tap |
The one candidates misplace is DAM. Application logging never records the DBA who connected with a client tool at midnight; DAM watches the wire, so when a stem describes a privileged user reading a table directly, DAM is the detective control and application logs are the distractor.
The WAF buys time; the gateway does not authorize objects
A WAF is a compensating control. Its best trick is virtual patching: a WAF rule blocks the exploit pattern for a known defect while the fix is built. Useful, and temporary. An encoding the rule did not anticipate walks through, and a business-logic flaw (a coupon applied twice) is invisible to a filter that only reads HTTP. A stem presenting the WAF as the permanent answer to an injection flaw is testing whether you know the fix is in the code, found by the testing pipeline of objectives 4.4 and 4.5.
The gateway limit is subtler. It can confirm the token is valid, the caller is within its rate limit and the request matches the schema. It cannot know that order 4471 belongs to a different customer. That is object-level authorization, the top item on the OWASP API Security Top 10, and only the service that owns the data can enforce it.
Cryptography inside the application
Objective 4.6 expects design rules rather than algorithm trivia. Use platform primitives, the provider's KMS and HSM and vetted libraries, never a home-grown algorithm. Use authenticated encryption, so tampered ciphertext is rejected rather than decrypted into nonsense. Run TLS everywhere, including between internal services, with certificate validation enabled; switching validation off discards the chain of trust that is the whole point. The application should call for an operation, not hold the key: keys live in the KMS, envelope encryption handles volume, passwords get a memory-hard salted hash, tokens come from a secure random source. And design for crypto-agility, storing algorithm and key identifiers with the ciphertext, because harvest-now-decrypt-later makes the post-quantum migration a question of when.
Sandboxes, containers and the boundaries that multiply
Sandboxing runs code in a constrained environment so its compromise does not reach the host or its neighbors. The tiers: process-level (dropped capabilities, seccomp filters, read-only root filesystem, non-root user), microVMs (hypervisor-grade isolation with container start times, how multi-tenant serverless isolates customers), the analysis sandbox that detonates suspicious files and that capable malware waits out, and the strongest, a separate account or project per environment and tenant.
Microservices are where boundaries multiply. Every call now needs its caller authenticated and its request authorized, which means mutual TLS and per-service identity issued automatically. A service mesh does that consistently, and distributed tracing with a correlation identifier makes a request that touched twelve services investigable. The trade to state: larger attack surface, smaller blast radius.
Kubernetes adds two defaults that surprise people. Pod-to-pod networking is unrestricted until a network policy says otherwise, and secrets are base64-encoded, not encrypted, unless encryption at rest is configured. Network policies and an external secrets manager are the remedies.
Federation is the trust; SSO is the experience
Objective 4.7 opens with a pair the exam separates deliberately. Federation is a trust relationship: a relying party accepts identity assertions from an identity provider it trusts instead of holding credentials itself. Single sign-on is the user-facing outcome: authenticate once, reach many applications. Federation commonly delivers SSO, but SSO exists without federation and federation exists without SSO.
| Protocol | What it does | The misunderstanding it is tested on |
|---|---|---|
| SAML 2.0 | XML assertions from identity provider to service provider | that it is obsolete; it remains the enterprise SaaS default |
| OAuth 2.0 | an authorization framework that issues scoped access tokens | that it authenticates users; an access token is not proof of identity |
| OpenID Connect | an authentication layer on OAuth 2.0 that adds a signed ID token | confusing it with OAuth; OIDC says who the user is |
| SCIM | automated provisioning and deprovisioning into applications | that federation alone deprovisions |
Federation's benefit is one credential lifecycle; its risk is concentration, because the identity provider becomes the most valuable target in the estate and its outage is everyone's outage. Protect its administrators with the strongest authentication and keep a tested break-glass path.
MFA that survives a proxy
"MFA is enabled" is where the analysis starts. The guide's own case is a finance director who approved a large payment with MFA satisfied, because the attacker proxied the login page and replayed the one-time code inside its window. The control did not fail; it did exactly what a shared secret can do, and the exam tests resistance. SMS codes are phishable in real time and fall to SIM swap. Authenticator codes survive SIM swap but can still be typed into a proxy. Push approval falls to fatigue, mitigated by number matching. Only credentials cryptographically bound to the origin resist an adversary-in-the-middle: FIDO2 and WebAuthn passkeys or security keys, and certificate-based authentication with the key in a TPM or smart card, because the browser will not release a signature for the wrong domain. Conditional access adds context and step-up for the management plane; privileged access management replaces standing rights with just-in-time elevation. The Security+ IAM primer has the definitions; CCSP wants the design choice.
CASB: four functions, three deployment modes
A cloud access security broker sits between users and cloud services to give visibility and control over SaaS the organization may not even have procured. Its four functions are visibility, compliance, data security and threat protection: discovering shadow SaaS, checking configuration against benchmarks, applying DLP and sharing controls, and catching anomalous access and risky OAuth grants. The questions, though, are about deployment mode, because each mode sees a different slice of traffic.
Most deployments combine API coverage for breadth with a proxy mode for real-time enforcement, and the stem's constraint (unmanaged devices, shadow SaaS, data already at rest) picks the mode.
The best secret is the one that does not exist
Three rules carry the secrets, keys and certificates part of 4.7. Prefer no secret at all: workload identity federation lets a pod, function or virtual machine obtain short-lived credentials by attested identity, so there is no static key to leak. Where a secret must exist, it lives in a secrets manager with automatic rotation, fetched at runtime, never baked into an image, a repository or a logged environment variable. And certificates are an inventory with automation: managed issuance, private keys in a KMS or HSM, automated renewal, expiry alerts with lead time, because expired certificates remain one of the most common causes of self-inflicted cloud outages.
Four stems, decoded
- A critical SQL injection flaw is found in a customer portal and the fix will take three weeks. What should the team do now? A WAF rule as a virtual patch, with the code fix kept on schedule. The WAF is compensating and temporary.
- A database administrator exported a customer table with a desktop client and application logs show nothing. Which control would have detected it? Database activity monitoring. It watches the wire, direct connections included.
- An attacker proxied the login page and replayed users' one-time codes in real time. Which MFA method would have prevented this? FIDO2 or WebAuthn, or certificate-based authentication. Only origin-bound credentials refuse to sign for the wrong domain.
- Real-time DLP is required for a sanctioned SaaS application used by partners on unmanaged devices. Which CASB mode fits? Reverse proxy. Agentless and inline; API mode acts after the fact, forward proxy misses unmanaged devices.
Key takeaways
- Place components by what they can see. WAF sees HTTP content, load balancer sees connections and ends TLS, API gateway sees API calls, XML firewall sees SOAP, DAM sees the database wire.
- The WAF buys time and the gateway skips object-level authorization. Virtual patching is compensating; only the owning service knows whose record it is.
- Application cryptography is a set of design rules. Platform primitives, authenticated encryption, TLS with validation on, keys the code calls but never holds.
- Federation is the trust, SSO is the experience, and only origin-bound MFA resists a proxy. OAuth authorizes, OIDC authenticates, SCIM deprovisions.
- CASB modes are chosen by the constraint. API for breadth, forward proxy for real-time shadow SaaS on managed devices, reverse proxy for unmanaged devices on sanctioned apps.
Cloud application architecture and IAM solutions are objectives 4.6 and 4.7 of CCSP Domain 4, Cloud Application Security, 16% of the exam. Work all 28 Domain 4 topics, from the OWASP lists through the secure SDLC, with our CCSP Domain 4 study guide.
#CCSP #ISC2 #CloudSecurity #APIGateway #WAF #CASB #Federation #MFA #InfoSec #CyberSecurity
Secure the code you did not write
Software assurance and verified software are two of seven objectives in CCSP Domain 4, 16% of the exam. Work all 28 topics, from awareness and the secure development lifecycle through testing, supply chain, application architecture and identity solutions, with 70 practice questions.
Get the CCSP Domain 4 guideKeep reading
Whose Law Applies? Jurisdiction, Blocking Statutes, Transfer Mechanisms, and eDiscovery in the Cloud
Cloud data has at least three addresses: where it is stored, where the provider is incorporated, and where the person it describes lives. CCSP Domain 6 on what happens when their laws disagree: conflicting jurisdiction and lawful access demands, blocking statutes, the mechanisms that make cross-border transfer legal, controller and processor duties and the privacy impact assessment, and eDiscovery and legal hold when the evidence is spread across a provider's regions.
Read CCSP deep divesSnapshot, Hash, Isolate: Digital Forensics When the Server Is Someone Else's
Every forensic rule you learned assumes you can pull the plug. In the cloud you cannot, and the disk belongs to someone else. CCSP Domain 5 on investigating on infrastructure you do not own: forensic readiness before the incident, isolate versus terminate, acquisition by snapshot and hash, chain of custody across a provider, what the provider will and will not give you, and the communication clock that starts the moment personal data is involved.
Read CCSP deep divesSAST, DAST, IAST, SCA: Testing the Cloud Application Pipeline, and the Supply Chain Attacks That Slip Past It
Most of a cloud application is code nobody on the team wrote. CCSP Domain 4 on making that safe: the four testing families and where each fits in the pipeline, black box against white box, abuse cases, why a passing test suite says nothing about a poisoned dependency, and the supply chain attacks the exam names, dependency confusion, typosquatting, compromised builds and copyleft licensing, with the software bill of materials that makes them visible.
ReadFollow Skillthropic
Keep learning between study sessions
The same exam-focused teaching, in smaller pieces, wherever you scroll.
Enjoyed this? Get the AI security news that matters.
Join The AI Security Brief for the top AI security news, plus what's important to the C-suite. Free, straight to your inbox.
No spam. Unsubscribe anytime.