4.9 Interpret API Authentication Mechanisms: Basic, Custom Token, and API Keys 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security operations team is integrating a third-party threat intelligence API into their SIEM. The API uses custom token authentication. The token is valid for 30 minutes and must be refreshed. The SIEM platform supports a single static credential for API integrations. What is the most appropriate way to handle token refresh?

   • AConfigure the SIEM to use the same token indefinitely until it fails
   • BUse the API key instead of the custom token
   • CCreate a middleware service that obtains the token, caches it, and injects it into requests made by the SIEM
   • DRequest a new token manually each time the SIEM needs to query the API
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does HTTP Basic authentication transmit credentials in an HTTP request?

   • AIn a custom header such as X-Api-Key, with the password hashed
   • BAs an encrypted token in the Authorization header, using a shared secret
   • CAs plaintext in the Authorization header, encoded with Base64
   • DIn the request body as a JSON object with username and password fields
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A developer is implementing custom token authentication for a web API. The token is a JSON Web Token (JWT) signed with a secret key. The developer needs to validate the token on each request. What is the most important validation step?

   • ADecode the token's payload to read the username
   • BEnsure the token is stored in an HttpOnly cookie
   • CCheck that the token is not empty
   • DVerify the token's signature using the secret key
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A network engineer is writing a Python script to pull device inventory from a network management API. The API documentation states it supports HTTP Basic authentication over HTTPS. The engineer needs to store the credentials securely and avoid hardcoding them in the script. Which approach should the engineer use?

   • ABase64-encode the username and password in the script and include them in the Authorization header manually
   • BGenerate an API key from the management platform and use it in the Authorization header
   • CStore the username and password in environment variables and pass them to the requests library's auth parameter
   • DUse a custom token obtained from a separate authentication endpoint
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How is an API key typically transmitted in an HTTP request?

   • AIn the URL path as part of the endpoint
   • BIn a custom header such as X-Api-Key or in the Authorization header
   • CIn a cookie that is automatically sent by the browser
   • DIn the request body as a JSON field
   Reveal Solution Discussion Select an answer first