API API Authentication & Security Testing 1 — Questions and Answers
Question 1: Which authentication mechanism uses a Bearer token included in the Authorization header?
- Basic Auth
- OAuth 2.0 / JWT (Correct answer)
- API Key in URL
- Digest Auth
Correct answer: OAuth 2.0 / JWT
OAuth 2.0 and JWT-based flows pass an access token as a Bearer token in the Authorization header.
Question 2: What is an API key primarily used for in API security testing?
- Encrypting the request body
- Identifying and authenticating the calling application (Correct answer)
- Compressing response data
- Rate limiting responses
Correct answer: Identifying and authenticating the calling application
An API key is a unique identifier passed with requests to authenticate the client application making the call.
Question 3: Which OWASP API Security risk involves an attacker accessing another user's data by manipulating object IDs?
- Excessive Data Exposure
- Broken Object Level Authorization (Correct answer)
- Security Misconfiguration
- Injection
Correct answer: Broken Object Level Authorization
Broken Object Level Authorization (BOLA/IDOR) occurs when APIs fail to verify the caller owns the object they are requesting.
Question 4: What does HTTPS ensure during API communication?
- Faster response times
- Encryption of data in transit (Correct answer)
- Server-side caching
- Automatic retry logic
Correct answer: Encryption of data in transit
HTTPS (HTTP over TLS) encrypts all data exchanged between client and server, preventing eavesdropping and tampering.
Question 5: Which attack involves sending malicious data in API input fields to manipulate backend database queries?
- CSRF
- SQL Injection (Correct answer)
- XSS
- Replay Attack
Correct answer: SQL Injection
SQL Injection exploits APIs that pass unsanitized user input directly into SQL queries, allowing attackers to read or alter the database.
Question 6: What is the purpose of rate limiting in API security?
- Improve response payload size
- Prevent abuse by limiting the number of requests per client (Correct answer)
- Enable CORS support
- Cache frequent responses
Correct answer: Prevent abuse by limiting the number of requests per client
Rate limiting restricts how many requests a client can make in a time window, protecting the API from brute force and DoS attacks.
API API Authentication & Security Testing 1
Which authentication mechanism uses a Bearer token included in the Authorization header?