Describe How End-To-End Encryption Principles Apply to APIs 350-901 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An API stores sensitive user data in a database and also transmits it over the network to clients. Which statement correctly describes the encryption requirements for this data?

   • AThe data must be encrypted both in transit (during transmission) and at rest (when stored in the database)
   • BEncryption is optional for both states if the API uses HTTPS
   • CThe data only needs encryption in transit because it is protected by the database's access controls
   • DThe data only needs encryption at rest because the network is considered secure
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company manages TLS certificates for multiple APIs. The security team wants to implement automated certificate rotation to reduce the risk of expiry outages. However, the operations team is concerned about the impact of rotation on API availability, as some clients may not support the new certificate immediately. Which approach best addresses both concerns?

   • ADisable certificate validation on clients to avoid issues
   • BRotate the certificate immediately without a transition period
   • CUse a certificate management tool that supports staged rollout, where the new certificate is deployed alongside the old one for a transition period
   • DUse a long-lived certificate to avoid frequent rotation
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is designing an API that handles both highly sensitive data (requiring strong encryption) and less sensitive data (where performance is critical). They want to minimize latency for the less sensitive data while maintaining strong encryption for the sensitive data. Which approach is most appropriate?

   • AUse TLS 1.3 with a strong cipher suite for all traffic, and optimize performance through session resumption and HTTP/2
   • BUse application-layer encryption for sensitive data and TLS for all traffic
   • CDisable TLS for less sensitive data and use TLS only for sensitive data
   • DUse TLS 1.2 with a weaker cipher suite for less sensitive data and a strong cipher suite for sensitive data
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is migrating an API from HTTP/1.1 to HTTP/2 to improve performance. The API currently uses TLS. The team notices that some legacy clients do not support HTTP/2. They want to maintain compatibility while improving performance for modern clients. Which approach is most appropriate?

   • AUse HTTP/2 only and drop support for legacy clients
   • BEnable HTTP/2 with TLS and allow HTTP/1.1 fallback for legacy clients
   • CDisable TLS and use HTTP/2 without encryption
   • DUse HTTP/1.1 with TLS and no HTTP/2
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary performance impact of enabling TLS encryption on API communications?

   • AIncreased latency due to the TLS handshake and encryption/decryption overhead
   • BIncreased API throughput due to faster data transfer
   • CReduced network bandwidth due to data compression
   • DDecreased server storage requirements
   Reveal Solution Discussion Select an answer first