A mobile app authenticates to an API with a key compiled into the build. Which change BEST reduces what extracting that key yields? A. Obfuscate the key, check the app signature B. Rotate the key in each quarterly release C. Short-lived per-user token from an authorization code D. Restrict the API to carrier address ranges THE SCENARIO · Kentmere Utilities · water utility metering 210,000 homes · State utility commission · AWIA Section 2013 risk and resilience · 900 rugged field tablets · customer mobile app · billing API · overnight meter-data service · Static keys in production, service account unowned The answer, why it is right, and why each of the other three is wrong — all in the video. Domain 5: Identity & Access Management (IAM) ISC2 CISSP exam outline: 5.1.5 Question #454 of the SecurePath Digital CISSP practice series Practice for the CISSP exam with me. Follow for a question a day, worked through end to end. #CISSP #CISSPExam #CyberSecurity #InfoSec #ISC2 #IAM #AccessControl