5.3 Describe REST API Security 350-401 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network automation team is building a tool that lets engineers trigger configuration backups on Cisco IOS XE devices via RESTCONF. The tool must authenticate each engineer individually and must not expose shared credentials in scripts. The team also needs to support Single Sign-On (SSO) with the corporate Active Directory. Which authentication approach should the team implement?

   • AHTTP Basic authentication with a service account
   • BOAuth 2.0 with OpenID Connect (OIDC) using the corporate identity provider
   • CClient certificates issued by an internal CA
   • DAPI keys generated per engineer
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When a REST API client connects to a server using HTTPS, what does the client validate to ensure it is communicating with the legitimate server?

   • AThe server's IP address
   • BThe client's API key
   • CThe server's TLS certificate
   • DThe server's firewall rules
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is deploying a web application that uses a REST API to manage customer data. The application must allow users to log in with their corporate credentials and then access only the API resources their role permits. The security team requires that the API never sees the user's password. Which authentication and authorization flow should the architect implement?

   • AOAuth 2.0 client credentials flow, where the web application authenticates itself and receives a token with all API permissions.
   • BBasic authentication, where the web application sends the user's password to the API in the Authorization header.
   • CAPI keys assigned to each user, with the web application sending the key in a custom header.
   • DOAuth 2.0 authorization code flow with OpenID Connect, using scopes to limit API access based on the user's role.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A network automation engineer is designing a REST API integration to configure network devices. Which threat is most directly mitigated by using HTTPS instead of HTTP for the API?

   • ACross-site request forgery (CSRF) attacks
   • BSQL injection in the API's database queries
   • CDenial-of-service attacks overwhelming the API
   • DMan-in-the-middle interception of credentials and data
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company's REST API for network automation experienced a security incident. The team needs to determine what happened and prevent future incidents. Which practice should be implemented?

   • ALog all API requests with timestamps, source IPs, and user identities, and monitor for anomalies
   • BDisable logging for authenticated users to protect privacy
   • CStore logs for only 24 hours to reduce storage costs
   • DLog only successful requests to reduce noise
   Reveal Solution Discussion Select an answer first