Describe How End-To-End Encryption Principles Apply to APIs 350-901 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A healthcare organization exposes a partner API for exchanging patient records. The security team requires that both the API server and the partner's client application prove their identity to each other before any data is exchanged. The partner's client is a server-side application, not a browser. Which mechanism should be configured?

   • ATLS with server certificate validation only
   • BMutual TLS (mTLS) with certificates issued to both the server and the partner client
   • COAuth 2.0 client credentials grant
   • DAPI keys in the HTTP header
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of encryption at rest for API data?

   • AUsing a VPN to connect to the API server
   • BUsing TLS 1.3 to secure API requests over the internet
   • CHashing API keys before storing them in a configuration file
   • DEncrypting the database files that store API response data
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   During a TLS handshake, what is the primary purpose of the server presenting its digital certificate to the client?

   • ATo prove the server's identity to the client
   • BTo negotiate the cipher suite to be used
   • CTo compress the data before transmission
   • DTo encrypt the session key for the client
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services company exposes a public REST API for account balance queries. A security auditor requires that the API guarantee that responses are not altered in transit and that the server the client is talking to is genuinely the bank's API. The client does not have a certificate. Which combination of controls satisfies the auditor's requirements?

   • AmTLS with both client and server certificates
   • BApplication-layer signing of every response with a shared HMAC key
   • CTLS with server certificate validation and a strong cipher suite
   • DTLS with a self-signed server certificate and no cipher suite restrictions
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company uses mTLS for a B2B API. The security policy requires that if a partner's client certificate is compromised, the API must stop accepting that certificate immediately, while other partners remain unaffected. Which key management practice directly supports this requirement?

   • AStore client certificates in a hardware security module (HSM)
   • BRotate the API server's certificate daily
   • CMaintain a certificate revocation list (CRL) or use OCSP to check certificate status on every request
   • DUse a single shared certificate for all partners
   Reveal Solution Discussion Select an answer first