API Security and Integration Best Practices CSE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A cloud API supports both authenticated and unauthenticated endpoints. The unauthenticated endpoints are used for public information, but they are being abused to launch DDoS attacks. The operations team wants to protect the API without affecting legitimate users. Which strategy is most effective?

   • AApply strict rate limiting to unauthenticated endpoints and use a CDN with DDoS protection
   • BRequire API keys for all endpoints, including public ones
   • CIncrease the API's auto-scaling limits to absorb the attack
   • DBlock all traffic from countries where the abuse originates
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A developer is building a cloud API that accepts JSON payloads. During a security review, the reviewer notes that the API directly inserts user-supplied fields into a SQL query and also returns raw error messages to the client. Which two changes should the developer prioritize?

   • AUse an ORM and return detailed database errors to help the client fix issues.
   • BEncode all output as HTML and disable TLS to simplify debugging.
   • CUse parameterized queries and implement a global exception handler that returns generic error messages.
   • DValidate input length and log full stack traces to the client for debugging.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   An API provider is planning to introduce a breaking change to its API. The provider wants to minimize disruption for existing clients while ensuring that the new version is secure. Which strategy should the provider adopt?

   • AModify the existing API in place and notify clients of the change.
   • BCreate a new endpoint without versioning and deprecate the old one immediately.
   • CKeep the old version running without any security updates to save effort.
   • DIntroduce a new API version and maintain the old version for a defined period with security patches.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A multinational company's API processes personal data of EU citizens. The API is hosted in a US cloud region. The compliance team is concerned about GDPR. What is the most appropriate action?

   • AAnonymize all personal data before processing
   • BEncrypt all data in transit and at rest
   • CObtain explicit consent from all users
   • DMove the API to an EU region and ensure data residency
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A company's API stores personal data and is subject to both GDPR and internal governance policies. The governance team requires that all data access be logged and that logs be retained for at least one year. The security team wants to minimize the risk of log tampering. Which approach should they implement?

   • AWrite logs to an immutable, append-only storage service and restrict access to the logs to authorized auditors.
   • BStore logs in a database table that administrators can edit for accuracy.
   • CEncrypt the logs but allow all developers to read them.
   • DRetain logs for only 30 days to reduce storage costs.
   Reveal Solution Discussion Select an answer first