API Security and Integration Best Practices CSE Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   An API accepts a file upload from users. The file is stored in cloud storage and later processed. What is the most important validation to prevent malicious file uploads?

   • ACheck the file extension against an allowlist
   • BValidate the file content type and size, and scan for malware
   • CStore the file with a random name in a private bucket
   • DAllow any file type but limit upload size
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A financial services company must audit all access to its customer data API. The compliance team requires a record of who accessed what data, when, and from where. Which logging practice is most critical?

   • ALog successful and failed requests with user identity, timestamp, source IP, and resource accessed
   • BLog all request and response bodies for every API call
   • CLog only failed authentication attempts
   • DStore logs in the same database as customer data
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A company is designing a new public API. The security team wants to implement a defense-in-depth strategy. Which combination of controls provides the most comprehensive protection?

   • AOAuth2 and rate limiting only
   • BTLS, OAuth2, input validation, rate limiting, logging, and versioning
   • CInput validation and logging only
   • DTLS and API keys only
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A company's internal API is accessed by multiple internal services. The security team wants to ensure that only authorized services can call the API, and that the communication is encrypted. What is the best approach?

   • AUse JWT tokens signed with a symmetric key
   • BUse mutual TLS (mTLS) with client certificates
   • CRely on the internal network being trusted
   • DUse a shared API key in the header
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A company is designing an API for a partner integration. The partners are external organizations, and each partner has multiple users. The company wants to authenticate the partner organization and also authorize individual users within that organization. They also need to revoke access for a single user quickly. Which approach should they choose?

   • AUse OAuth2 with the authorization code flow, where the partner organization issues tokens to its users and the API validates the tokens.
   • BIssue a single API key to each partner and share it among all users.
   • CUse JWT with a long expiration time to avoid frequent re-authentication.
   • DUse HTTP Basic authentication with each user's credentials stored in the API's database.
   Reveal Solution Discussion Select an answer first