API API Authentication & Security Testing

Question 1

Which authentication mechanism uses a Bearer token included in the Authorization header?

Accepted Answer

OAuth 2.0 / JWT

Answer

OAuth 2.0 and JWT-based flows pass an access token as a Bearer token in the Authorization header.

Question 2

What is an API key primarily used for in API security testing?

Accepted Answer

Identifying and authenticating the calling application

Answer

An API key is a unique identifier passed with requests to authenticate the client application making the call.

Question 3

Which OWASP API Security risk involves an attacker accessing another user's data by manipulating object IDs?

Accepted Answer

Broken Object Level Authorization

Answer

Broken Object Level Authorization (BOLA/IDOR) occurs when APIs fail to verify the caller owns the object they are requesting.

Question 4

What does HTTPS ensure during API communication?

Accepted Answer

Encryption of data in transit

Answer

HTTPS (HTTP over TLS) encrypts all data exchanged between client and server, preventing eavesdropping and tampering.

Question 5

Which attack involves sending malicious data in API input fields to manipulate backend database queries?

Accepted Answer

SQL Injection

Answer

SQL Injection exploits APIs that pass unsanitized user input directly into SQL queries, allowing attackers to read or alter the database.

API - Testing Practice Test