Which IAM Token Risk Is Most Concerning?
An application security engineer is examining the IAM configuration for a workload. The following is a sample of the decoded payload and header:
Which of the following is the most concerning risk?
Community Insight
The question tests whether you can read a decoded authentication token and spot claim/role manipulation as the primary risk; the trap is picking an attack that does not involve the token payload at all, such as credential stuffing.
When an application security engineer decodes a workload's IAM token header and payload, the critical question is whether the signed claims (such as role or privilege fields) can be altered or trusted improperly. The exhibit points to privilege escalation as the top concern, because a tamperable or weakly validated token lets an attacker elevate a service account's rights inside the workload.
Many learners choose C (credential stuffing), because it is a familiar IAM attack name, but credential stuffing targets login endpoints with stolen username/password pairs and has nothing to do with a decoded token header and payload.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The exhibit shows a decoded token header and payload, which is the format of a JWT-style assertion used by the workload's IAM layer. Because the payload carries identity and role claims (including a service-account role), any weakness in how the service validates the header (for example algorithm confusion, "none" algorithm acceptance, or insufficient signature checks) lets an attacker rewrite those claims and grant themselves higher privileges. That outcome is privilege escalation, option B, and it is the most concerning risk because it directly expands what a compromised or forged token can do inside the workload. It is also the risk with the widest blast radius, since elevated claims propagate to every downstream authorization decision the workload makes.Why the Other Options Are Wrong
C, credential stuffing, attacks authentication endpoints with lists of stolen credentials; a decoded token payload and header analysis does not involve password guessing at all. A, lateral movement, is a post-compromise technique where an attacker pivots between systems, not a flaw revealed by inspecting a single token's claims. D, RCE from deserialization, applies to unsafe object deserialization of binary or serialized objects, whereas a JSON token payload parsed as claims does not execute code. None of these three explain why decoding this specific header/payload should alarm the engineer.Community Comment Notes
Trynapasslol argued for B, noting "the account role is a "svc acct" so it is susceptible to Privilege Escalation once compromised," which aligns with the claim-tampering risk in the exhibit. Skri113xX insisted "Without a doubt, it's C," citing a recent lab, but credential stuffing does not connect to a decoded token payload and header. Since the anonymous votes are split and no vote majority is evidence, the token-claim analysis stands on its own: tamperable authorization claims equal privilege escalation.Official Reference
Exam Strategy
For decoded payload/header exhibits, first identify the token format, then ask which single claim an attacker could change and what that change would buy them. Choose the risk that maps directly to the tampered field, and eliminate options that describe unrelated attack stages like password guessing or post-exploitation pivoting.
Frequently Asked Questions
Why is credential stuffing wrong when the question shows IAM configuration?
Credential stuffing targets login endpoints with stolen password lists; a decoded token header and payload exhibit concerns claim validation, not password guessing.
How does a service-account role in the payload create privilege escalation?
If signature or algorithm checks are weak, an attacker rewrites the role claim in the payload to inherit the service account's elevated permissions.
Related Analysis
Practice All CAS-005 Questions
Access 135 questions with complete answers and detailed explanations.
View Full CAS-005 Practice Test →