API API Authentication & Security Testing 2 — Questions and Answers
Question 1: What does JWT stand for in the context of API authentication?
- Java Web Token
- JSON Web Token (Correct answer)
- JavaScript Webservice Transport
- JSON Workflow Transaction
Correct answer: JSON Web Token
JWT (JSON Web Token) is a compact, URL-safe token format used to securely transmit claims between client and server.
Question 2: Which part of a JWT contains the user claims and data?
- Header
- Payload (Correct answer)
- Signature
- Algorithm
Correct answer: Payload
The JWT Payload is the middle Base64URL-encoded section that contains the claims, such as user ID, roles, and expiration time.
Question 3: What is CORS and why is it important in API security testing?
- A caching strategy for APIs
- A browser mechanism controlling cross-origin requests (Correct answer)
- A token refresh protocol
- An encryption standard for API keys
Correct answer: A browser mechanism controlling cross-origin requests
CORS (Cross-Origin Resource Sharing) is a browser policy that controls which origins can call an API, preventing unauthorized cross-site requests.
Question 4: Which HTTP status code does an API return when a request lacks valid authentication credentials?
- 400 Bad Request
- 401 Unauthorized (Correct answer)
- 403 Forbidden
- 404 Not Found
Correct answer: 401 Unauthorized
401 Unauthorized means the request requires authentication that was not provided or is invalid.
Question 5: What is a replay attack in the context of API security?
- Sending the same valid request multiple times to exploit the API (Correct answer)
- Replaying a video response
- Retrying failed requests automatically
- Caching and replaying API responses
Correct answer: Sending the same valid request multiple times to exploit the API
A replay attack reuses a captured valid API request (including its token) to perform unauthorized actions.
Question 6: Which security testing technique sends unexpected or malformed data to an API to discover vulnerabilities?
- Load testing
- Fuzzing (Correct answer)
- Smoke testing
- Contract testing
Correct answer: Fuzzing
Fuzzing (or fuzz testing) feeds random, invalid, or malformed inputs to an API to uncover crashes, errors, and security flaws.
API API Authentication & Security Testing 2
What does JWT stand for in the context of API authentication?