5.3 Describe REST API Security 350-401 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A network engineer is configuring a REST API client to interact with a Cisco DNA Center controller. The client is receiving a certificate validation error. The engineer has verified that the controller's certificate is signed by a trusted internal CA. What is the most likely cause of the error?

   • AThe client does not trust the internal CA that signed the controller's certificate.
   • BThe controller is using TLS 1.0, which is deprecated.
   • CThe API key is invalid.
   • DThe client is using HTTP instead of HTTPS.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A REST API for network automation is being abused by a botnet that rotates IP addresses. The API uses per-IP rate limiting. The abuse continues. Which additional measure should be implemented?

   • AImplement rate limiting based on API keys or authenticated users
   • BBlock all traffic from unknown IPs
   • CIncrease the per-IP rate limit
   • DDisable rate limiting to avoid false positives
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network automation platform accepts user-supplied strings to filter device inventory via a REST API. The API backend constructs a database query from the input. A security review found that a user could inject SQL commands. Which mitigation should be implemented?

   • AEncode the input with base64 before querying
   • BUse parameterized queries and validate input against an allowlist
   • CRestrict API access to internal users only
   • DUse a web application firewall (WAF) to block all SQL keywords
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A network engineer is configuring a REST API client to communicate with a Cisco device. The device supports HTTPS but the certificate is signed by an internal CA. The client script is failing because it does not trust the CA. What should the engineer do?

   • AUse HTTP instead of HTTPS
   • BAdd the internal CA certificate to the client's trust store
   • CUse the device's IP address instead of hostname
   • DDisable certificate validation in the client
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A developer is writing a REST API endpoint that accepts a device hostname as a query parameter and uses it to build a CLI command that is executed on a network device. A security review flags that a malicious user could inject additional commands. Which mitigation should the developer implement?

   • AEncode the hostname using URL encoding before passing it to the CLI command.
   • BValidate the hostname against a strict regular expression that allows only alphanumeric characters, hyphens, and dots.
   • CUse a longer timeout for the API request to allow the command to complete.
   • DLog the full command string including the hostname for audit purposes.
   Reveal Solution Discussion Select an answer first