Describe How End-To-End Encryption Principles Apply to APIs 350-901 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the context of API security, what does the principle of integrity ensure?

   • AThe data is encrypted and unreadable to third parties
   • BThe data has not been modified during transmission
   • CThe client has permission to access the API
   • DThe API server is always available to respond
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A team is deploying a high-throughput API and is concerned about the CPU overhead of TLS encryption on the application servers. They want to offload the cryptographic work. Which solution is most appropriate?

   • AIncrease the number of application servers
   • BTerminate TLS at a dedicated load balancer or API gateway
   • CUse a weaker cipher suite to reduce CPU usage
   • DDisable TLS and rely on network-level security
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company uses mTLS for a critical B2B API. The security team wants to rotate the client certificates every 90 days to reduce the impact of a compromise. However, the operations team is concerned about the overhead of manually updating certificates on all partner systems. Which approach balances security and operational overhead?

   • AUse a single shared certificate for all partners to simplify management
   • BDisable certificate revocation checks to reduce overhead
   • CExtend the certificate validity to 2 years to reduce rotation frequency
   • DImplement automated certificate distribution and renewal using a standard protocol like ACME or a centralized certificate management system
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is implementing mTLS for a partner API. The security team requires that the partner's client certificate be validated against a private CA, and that the certificate be revoked immediately if the partner's private key is compromised. The operations team wants to minimize the overhead of checking certificate status on every request. Which approach best meets both requirements?

   • ADisable certificate revocation checks to reduce overhead
   • BUse OCSP stapling on the API server to provide certificate status to clients, and use a CRL for the server to check client certificates
   • CUse a long-lived certificate and rely on the partner to report compromise
   • DUse a CRL that is updated daily and cache the status on the API server
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A DevOps team is tuning an API gateway that handles high-frequency, low-payload requests. They notice that TLS handshake latency is a significant contributor to overall response time. They want to reduce the handshake overhead without weakening security. Which approach best addresses this?

   • ASwitch to a weaker cipher suite with smaller key sizes
   • BEnable TLS session resumption using session tickets or session IDs
   • CDisable TLS and rely on application-layer encryption
   • DIncrease the TLS record size to reduce the number of records
   Reveal Solution Discussion Select an answer first