2. Describe Common Usage Patterns Related to Webhooks 200-901 Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company is implementing a webhook receiver for a network device that sends configuration change notifications. The receiver must be publicly accessible, but the company is concerned about unauthorized requests. The device supports HMAC-SHA256 signatures. The team wants to minimize the risk of replay attacks. Which additional measure should they implement?

   • AUse a static API key in the URL to authenticate requests.
   • BRely solely on the HMAC signature to prevent replay attacks.
   • CInclude a timestamp in the payload and reject requests with a timestamp older than a few minutes.
   • DRestrict the webhook URL to accept requests only from the device's IP address.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A webhook receiver is receiving payloads from multiple sources. Each payload contains a 'source' field and a 'signature' field. The receiver needs to verify the signature using a different secret for each source. What is the best way to manage this?

   • AIgnore the signature and rely on the 'source' field to trust the payload.
   • BUse a single shared secret for all sources to simplify verification.
   • CMaintain a mapping of source to secret and use the 'source' field to look up the appropriate secret for signature verification.
   • DStore all secrets in a database and try each one until the signature matches.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which practice is commonly used to secure webhook deliveries?

   • AIncluding a secret token in the payload and verifying it on the receiving end
   • BSending the webhook to a public URL without any authentication
   • CUsing HTTPS and verifying a signature in the request headers
   • DUsing HTTP instead of HTTPS to avoid encryption overhead
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In a typical webhook flow, what happens immediately after an event occurs?

   • AThe client sends a GET request to the server to check for updates
   • BThe client sends an HTTP POST request to the server to acknowledge the event
   • CThe server sends an HTTP POST request to the registered webhook URL
   • DThe server opens a WebSocket connection to the client
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A developer is integrating a third-party service that sends webhooks. The service requires the developer to provide a URL that is publicly accessible. The developer's application runs on a private network. What should the developer do to receive webhooks?

   • APoll the third-party service for events instead of using webhooks.
   • BProvide the private IP address of the application as the webhook URL.
   • CExpose a public endpoint, such as a reverse proxy or API gateway, that forwards incoming webhooks to the private application.
   • DUse a VPN tunnel to allow the third-party service to reach the private network directly.
   Reveal Solution Discussion Select an answer first