5.3 Describe REST API Security 350-401 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization is deploying a REST API for network device configuration. The API must allow network engineers to modify configurations, but help desk staff should only be able to view device status. The team wants to enforce these permissions centrally. Which approach should be used?

   • AUse a single API key for all users
   • BDisable write methods on the API
   • CRely on client-side filtering of API responses
   • DImplement RBAC with roles mapped to API scopes
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A network automation team is deploying a REST API client that must connect to multiple Cisco devices. Each device uses a different self-signed certificate. The team wants to maintain secure communication without manual intervention for each device. Which approach should be used?

   • AUse a common internal CA to sign device certificates and trust that CA
   • BDisable certificate validation for convenience
   • CImplement certificate pinning for each device
   • DUse HTTP for all device communication
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A network operations team has implemented a REST API for device provisioning. The API is protected by rate limiting and authentication. The security team wants to detect a slow, distributed brute-force attack that uses many different source IPs and low request rates to avoid triggering rate limits. Which logging and monitoring strategy is most effective?

   • ALog only the source IP for each request.
   • BIncrease the rate limit to allow more requests per IP.
   • CAggregate authentication failure logs by username and correlate with successful logins from different IPs.
   • DDisable logging for successful authentication to reduce noise.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A REST API for network automation accepts JSON payloads to configure devices. A security audit found that the API is vulnerable to command injection because user input is passed to a shell command. The team must fix the vulnerability without breaking legitimate functionality. Which approach is the most effective?

   • ALog all input and review it manually
   • BRun the shell command in a sandboxed environment
   • CEscape shell metacharacters in the input
   • DUse an allowlist of permitted commands and validate all input against it
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A network automation platform uses API keys for authentication. The team wants to rotate keys regularly to reduce risk. However, some scripts hardcode the keys and are difficult to update. Which approach should the team implement?

   • AShare the API key among all scripts
   • BKeep the same keys to avoid script changes
   • CUse a secrets management service to store and rotate keys, and update scripts to retrieve keys dynamically
   • DUse Basic authentication instead of API keys
   Reveal Solution Discussion Select an answer first