4.6 Determine the Constraints When Consuming APIs Such as Rate Limited, Timeouts, and Payload 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security automation team is building a script that queries a vendor API to pull indicators of compromise (IOCs). The API has a rate limit of 60 requests per minute and returns a 429 status with a Retry-After header when the limit is exceeded. The script needs to pull 500 IOCs, and each request returns up to 10 IOCs. The team wants to minimize the time to complete the pull while avoiding further throttling. What should the team implement?

   • AImplement a fixed delay of 1 second between requests and retry on 429 with exponential backoff.
   • BIncrease the timeout to 30 seconds to allow the API to process more requests.
   • CUse multiple API keys to distribute the requests and avoid the rate limit.
   • DSend all 500 IOCs in a single request to avoid the rate limit.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is building a script that consumes a threat intelligence API. The API returns JSON responses, and the analyst's code expects a field called 'indicators' to be an array. In one response, the 'indicators' field is missing entirely. The analyst's code currently throws an exception when the field is missing. The analyst needs to handle this gracefully. What should the analyst do?

   • AChange the request to use XML instead of JSON to avoid the missing field.
   • BIgnore the response and continue with the next request.
   • CRetry the request to see if the API returns the field on the next attempt.
   • DUse a default value of an empty array when the 'indicators' field is missing.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security automation script is consuming a public threat-intelligence API. The provider enforces a maximum number of requests per minute per API key. What is the primary reason the provider implements this constraint?

   • ATo guarantee that every client receives identical response times for all requests
   • BTo prevent clients from sending malformed JSON payloads that could corrupt the database
   • CTo force clients to use a specific authentication method such as OAuth2
   • DTo ensure fair usage and protect the API backend from being overwhelmed by excessive traffic
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An API endpoint returns a large dataset that could exceed the provider's maximum response payload size. What is the standard mechanism used by REST APIs to allow clients to retrieve large datasets in smaller chunks?

   • APagination
   • BCaching
   • CCompression
   • DRate limiting
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An API client receives a 401 Unauthorized response. What is the most likely cause of this error?

   • AThe requested resource does not exist
   • BThe server is temporarily unable to handle the request
   • CThe client is authenticated but does not have permission to access the resource
   • DThe client did not provide valid authentication credentials
   Reveal Solution Discussion Select an answer first