API API Authentication and Security 3

Question 1

What does 'Broken Object Level Authorization' (BOLA) mean in API security?

Accepted Answer

A user accessing objects they don't own by manipulating IDs

Answer

Invalid JSON object formatting

Answer

A broken API schema

Answer

Failed object serialization

Question 2

Which HTTP response header helps prevent clickjacking attacks on API-served content?

Accepted Answer

X-Frame-Options

Answer

Content-Type

Answer

Cache-Control

Answer

Accept-Encoding

Question 3

What is an API security token expiry time best practice?

Accepted Answer

Use short expiry with refresh tokens

Answer

Never expire tokens

Answer

Set long expiry to reduce re-authentication

Answer

Expire tokens only on logout

Question 4

What does 'mass assignment' vulnerability in APIs involve?

Accepted Answer

Binding user input directly to internal object properties without filtering

Answer

Assigning too many users to a role

Answer

Creating bulk test data

Answer

Assigning multiple HTTP methods to one endpoint

Question 5

Which security practice involves validating that API inputs match expected formats and ranges?

Accepted Answer

Input validation

Answer

Rate limiting

Answer

Token rotation

Answer

Response filtering

Question 6

What is the purpose of an API gateway in security architecture?

Accepted Answer

Centralize authentication, rate limiting, and routing for APIs

Answer

Store API documentation

Answer

Generate test data

Answer

Compress API responses