API API Authentication and Security 2 — Questions and Answers
Question 1: What is rate limiting in API security?
- Encrypting API traffic
- Restricting the number of requests a client can make in a time window (Correct answer)
- Validating response schemas
- Checking SSL certificates
Correct answer: Restricting the number of requests a client can make in a time window
Rate limiting restricts the number of API requests a client can make within a specific time window to prevent abuse and DoS attacks.
Question 2: What does HTTPS provide that HTTP does not?
- Faster data transfer
- Encrypted transmission of data (Correct answer)
- Better caching
- Stateful connections
Correct answer: Encrypted transmission of data
HTTPS uses TLS/SSL to encrypt data in transit, preventing eavesdropping and man-in-the-middle attacks.
Question 3: Which OWASP API vulnerability involves an API returning more data than the client needs?
- Broken Object Level Authorization
- Excessive Data Exposure (Correct answer)
- Security Misconfiguration
- Injection
Correct answer: Excessive Data Exposure
Excessive Data Exposure occurs when an API returns more data than necessary, relying on clients to filter it, exposing sensitive information.
Question 4: What is CORS in the context of API security?
- A caching mechanism
- A cross-origin resource sharing policy controlling browser requests (Correct answer)
- An encryption standard
- A token format
Correct answer: A cross-origin resource sharing policy controlling browser requests
CORS (Cross-Origin Resource Sharing) is a browser security policy that controls which origins can make requests to an API.
Question 5: What is SQL injection in API testing?
- Inserting valid SQL into the database
- Injecting malicious SQL through API inputs to manipulate the database (Correct answer)
- A method for seeding test data
- Optimizing SQL queries in API calls
Correct answer: Injecting malicious SQL through API inputs to manipulate the database
SQL injection involves sending malicious SQL code through API parameters to manipulate or access the database unauthorized.
Question 6: Which grant type in OAuth 2.0 is recommended for server-to-server API communication?
- Authorization Code
- Client Credentials (Correct answer)
- Implicit
- Password
Correct answer: Client Credentials
The Client Credentials grant type is designed for machine-to-machine communication where no user is involved.
API API Authentication and Security 2
What is rate limiting in API security?