4.9 Interpret API Authentication Mechanisms: Basic, Custom Token, and API Keys 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does a server typically validate a custom token presented by a client?

   • ABy decrypting the token with the client's public key
   • BBy checking the token's signature and expiration, possibly against a token store
   • CBy sending the token back to the client for confirmation
   • DBy comparing the token to the client's password hash stored in the database
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Compared to Basic authentication, what is a key advantage of custom token authentication?

   • AIt allows the server to identify the client without any shared secret
   • BIt is simpler to implement because it uses standard HTTP headers
   • CIt does not require any encryption or hashing
   • DCredentials are not sent with every request, reducing exposure
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which scenario is most appropriate for using API key authentication?

   • AProviding fine-grained authorization based on user roles
   • BAuthenticating individual users with a username and password
   • CIdentifying a third-party application or service accessing a public API
   • DEnsuring that requests are not tampered with in transit
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is exposing a public API to third-party developers. The API uses API key authentication. The company wants to track usage per developer and enforce rate limits. What is the best way to achieve this?

   • AIssue a single shared API key for all developers
   • BUse custom token authentication with a single token
   • CUse HTTP Basic authentication with per-developer credentials
   • DIssue a unique API key to each developer and enforce rate limits per key
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network engineer is automating configuration backups from a network device. The device API supports both HTTP Basic authentication and API key authentication. The engineer wants to minimize the risk of credential exposure in logs. Which authentication method should the engineer use?

   • AEither method, as they are equally secure
   • BAPI key authentication
   • CHTTP Basic authentication
   • DNeither method, as both are insecure
   Reveal Solution Discussion Select an answer first