5.3 Describe REST API Security 350-401 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which protocol is built on top of OAuth 2.0 and provides identity information about the user in the form of an ID token?

   • ALightweight Directory Access Protocol (LDAP)
   • BSecurity Assertion Markup Language (SAML)
   • CRemote Authentication Dial-In User Service (RADIUS)
   • DOpenID Connect (OIDC)
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company's REST API for network automation is experiencing occasional bursts of legitimate traffic that trigger rate limits, causing user complaints. The team also needs to protect against DDoS attacks. Which rate limiting strategy should be implemented?

   • ADisable rate limiting during peak hours
   • BUse a single global rate limit for all users
   • CImplement token bucket throttling with a higher burst limit and lower sustained rate
   • DImplement fixed window rate limiting with a low limit
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A REST API accepts a JSON payload to configure a network device. A security analyst discovers that a user can send a payload with a very deeply nested JSON structure, causing the API to consume excessive CPU and memory. Which control should be implemented to prevent this?

   • AValidate the JSON payload size and nesting depth before processing.
   • BLog the payload for later analysis.
   • CRequire the user to authenticate with a stronger password.
   • DUse a more powerful API server.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which authentication method for REST APIs is considered the least secure when used without HTTPS because credentials are sent in a predictable format?

   • AOAuth 2.0 with bearer tokens
   • BBasic authentication
   • CToken-based authentication
   • DAPI key authentication
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security audit of a REST API that configures network devices reveals that the API accepts a 'description' field in a JSON payload and inserts it into a CLI command without sanitization. An attacker has exploited this to execute arbitrary commands on the device. The remediation must prevent this class of attack while minimizing changes to the API's functionality. Which approach is most effective?

   • ALog all API requests and review them manually.
   • BUse parameterized commands or an API that does not concatenate user input into CLI strings.
   • CSanitize the description field by removing semicolons and ampersands.
   • DIncrease the API's authentication requirements to require multi-factor authentication.
   Reveal Solution Discussion Select an answer first