5.3 Describe REST API Security 350-401 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of TLS in REST API communications?

   • ATo prevent SQL injection attacks
   • BTo encrypt the data exchanged between client and server
   • CTo rate-limit API requests
   • DTo authenticate the user's identity
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary goal of input validation in a REST API?

   • ATo limit the number of requests
   • BTo ensure that only properly formatted and safe data is processed
   • CTo encrypt data in transit
   • DTo authenticate users
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A REST API for a network automation platform is experiencing intermittent slowdowns. The operations team notices that a single internal application is making thousands of requests per second, while other applications are making far fewer. The team wants to ensure fair access for all applications. Which policy should the team implement?

   • AImplement global rate limiting for the entire API.
   • BDisable API caching to reduce memory usage.
   • CIncrease the API server's connection timeout.
   • DImplement per-client rate limiting based on API keys.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization is integrating a third-party monitoring tool with its Cisco Meraki REST API. The tool only needs to read network health data, but the API key provided has full read-write access to all organizations. The security team wants to minimize the risk if the key is compromised. Which action should the team take?

   • AUse the existing full-access key and rely on the monitoring tool's internal security.
   • BCreate a new API key with read-only scopes and restrict it to the specific network or organization.
   • CDisable the API entirely and use screen scraping.
   • DRotate the full-access key every 90 days.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A network operations team exposes a REST API for external partners to query device inventory. After a partner's script malfunctioned, the API became unresponsive due to a flood of requests. The team wants to prevent a single partner from overwhelming the API while allowing all partners to access it. Which configuration should the team implement?

   • ARequire all partners to use a shared API key for authentication.
   • BConfigure rate limiting per API key, allowing a maximum number of requests per minute for each partner.
   • CDisable logging for API requests to reduce processing overhead.
   • DIncrease the API server's memory and CPU to handle the maximum possible request load.
   Reveal Solution Discussion Select an answer first