5.3 Describe REST API Security 350-401 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A REST API is being overwhelmed by a flood of requests from a single client, causing service degradation for other users. Which security control is specifically designed to limit the number of requests a client can make in a given time period?

   • ARate limiting
   • BInput validation
   • CTLS encryption
   • DRole-based access control
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A network automation platform exposes a REST API. The security team wants to detect a brute-force attack on the API's authentication endpoint. Which logging and monitoring practice should the team implement?

   • ADisable logging for the authentication endpoint to protect user privacy.
   • BLog the full request body for every authentication attempt.
   • CLog all authentication failures with source IP, username, and timestamp, and alert when failures exceed a threshold.
   • DLog only successful authentication attempts to reduce log volume.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large enterprise exposes a REST API for network automation. The API is critical and must remain available. Recently, a distributed denial-of-service (DDoS) attack used a botnet to overwhelm the API. The team implemented rate limiting per IP, but the attack continues because the botnet rotates IPs. The team also needs to maintain visibility for incident response. Which combination of measures should the team implement?

   • AUse a CDN to absorb the attack and disable rate limiting
   • BBlock all traffic from unknown IPs and keep per-IP rate limiting
   • CIncrease the per-IP rate limit and disable logging to reduce overhead
   • DImplement rate limiting per authenticated user and enable detailed logging with anomaly detection
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A REST API accepts a JSON payload to configure network devices. A security scan found that the API is vulnerable to cross-site scripting (XSS) because it reflects user input in error messages. Which mitigation should be applied?

   • ASanitize and encode all user input before reflecting it in responses
   • BUse HTTPS to encrypt the API traffic
   • CRestrict API access to internal users
   • DValidate that the JSON payload is well-formed
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is deploying a REST API for network configuration. The API uses OAuth 2.0 with scopes. The security team wants to enforce that a user with the 'network-admin' role can modify configurations, while a user with the 'network-viewer' role can only read them. The API receives an access token with the scope 'network:read'. Which action should the API take?

   • AAllow the request because the user is authenticated.
   • BDeny the request if the operation is a write operation, because the token only has read scope.
   • CAllow the request and log it for audit purposes.
   • DRequest a new token with write scope from the authorization server.
   Reveal Solution Discussion Select an answer first