API API Authentication & Security Testing 3

Question 1

What does OAuth 2.0 authorization code flow primarily protect against compared to the implicit flow?

Accepted Answer

Exposing access tokens in the browser URL

Answer

Slow token exchange

Answer

Invalid JSON payloads

Answer

Missing rate limits

Question 2

Which OWASP API Security risk occurs when an API returns more data than the client needs?

Accepted Answer

Excessive Data Exposure

Answer

Broken Authentication

Answer

Lack of Resources & Rate Limiting

Answer

Broken Object Level Authorization

Question 3

What is the recommended way to store API keys in client-side applications?

Accepted Answer

Store them in environment variables or a secrets manager, never in frontend code

Answer

Hardcode them in JavaScript source files

Answer

Store them in localStorage

Answer

Embed them in the HTML

Question 4

What does the term 'mass assignment' vulnerability mean in API security?

Accepted Answer

An API blindly binding user-supplied fields to internal object properties

Answer

Assigning too many roles to a user

Answer

Sending bulk requests to the API

Answer

Assigning multiple API keys to one account

Question 5

Which tool is commonly used for API security scanning and vulnerability detection?

Accepted Answer

OWASP ZAP

Answer

Selenium

Answer

Grafana

Answer

Swagger Editor

Question 6

What is the primary purpose of certificate pinning in API security?

Accepted Answer

Prevent man-in-the-middle attacks by validating the server's exact certificate

Answer

Speed up TLS handshakes

Answer

Cache API responses

Answer

Enable mutual authentication