5.3 Describe REST API Security 350-401 Practice Questions (Page 9)

Questions 41–43

1. 41foundation · easy

   In OAuth 2.0, a client requests a token with a 'scope' of 'read-only'. What does this scope control?

   • AThe rate limit applied to the client
   • BThe lifetime of the token
   • CThe specific API resources and actions the token can access
   • DThe encryption algorithm used for the token
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is integrating a REST API with OAuth 2.0. The API must allow users to delegate limited access to third-party applications. The team wants to ensure that users can grant and revoke access without administrator intervention. Which OAuth 2.0 feature should be used?

   • AUser consent and token revocation
   • BImplicit grant with short-lived tokens
   • CClient credentials grant with long-lived tokens
   • DAPI keys with manual rotation
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A managed service provider (MSP) exposes a REST API to its customers for provisioning network services. The API uses API keys for authentication. A customer's application is misconfigured and is sending a high volume of requests, causing performance degradation for other customers. The MSP wants to protect the API without affecting legitimate customers. The MSP also needs to identify the source of the problem quickly. Which combination of controls should the MSP implement?

   • AImplement per-key rate limiting and log request counts per API key with alerts on threshold breaches.
   • BIncrease the API server's capacity and rely on the customer to fix the issue.
   • CRequire all customers to use a shared API key and implement rate limiting on that key.
   • DImplement a global rate limit for the entire API and disable logging to reduce overhead.
   Reveal Solution Discussion Select an answer first