ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Security controls must be selected and ordered according to the magnitude of the risks they mitigate. In this scenario, loss of API credentials is assessed as having both high likelihood and severe impact because it can lead directly to unauthorized disclosure of electronic protected health information (ePHI)-a primary confidentiality concern under regulations such as HIPAA. Deploying a privileged-access management (PAM) solution that centrally stores, rotates, and audits API secrets directly addresses the highest-ranked risk by reducing the chance that compromised credentials can be reused or remain undetected. While rate-limiting, encryption at rest, and multi-region failover are valuable, they primarily tackle availability threats or limit damage after data is already stolen. Therefore, prioritizing strong credential governance through PAM provides the greatest immediate risk reduction.