API Security and Integration Best Practices CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company exposes a public REST API for its mobile app. The security team requires that each request be authenticated without storing session state on the server, and that the API reject requests that originate from a client that has been compromised and is making excessive calls. Which combination of controls should the team implement?

   • AImplement OAuth2 with opaque tokens stored in a server-side session and disable rate limiting to avoid false positives.
   • BUse HTTP Basic authentication with the user's password and add a CAPTCHA to every API call.
   • CIssue short-lived JWTs signed with a shared secret and configure an API gateway to enforce rate limiting per client ID.
   • DUse long-lived API keys in the Authorization header and rely on the application server to log all requests.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is integrating a third-party API that occasionally returns malformed JSON and has a history of slow responses. The integration must be resilient and must not leak internal error details to end users. Which approach should the developer take?

   • ARetry the API call indefinitely until a valid response is received.
   • BLog the full response and return it to the client for debugging.
   • CWrap the API call in a try-catch block, validate the response schema, and return a generic error to the client.
   • DAssume the API always returns valid JSON and let exceptions propagate to the client.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A startup is building a public API for its new service. The team wants to implement a security baseline. Which combination of controls is most effective?

   • AUse JWT without expiration to simplify client development
   • BUse only TLS and rely on the cloud provider's firewall
   • CUse API keys, rate limiting, and TLS
   • DUse OAuth2, but do not log requests to protect privacy
   Reveal Solution Discussion Select an answer first
5. 14expert · hard · select all that apply

   A security team is planning a penetration test for a public API. The test must be comprehensive and minimize risk to production data. Which of the following practices should be included? (Select all that apply.)

   • AUse automated scanners and manual testing techniques
   • BTest against a staging environment that mirrors production
   • CTest only the authentication mechanisms
   • DObtain written authorization from the API owner
   • ERun the test against production with a test API key
   Check answers Discussion Select an answer first
6. 15foundation · easy

   When integrating an API with a cloud service, what is a best practice for handling errors?

   • AReturn the same error message for all failures to simplify client handling
   • BReturn detailed stack traces to the client to help debugging
   • CReturn generic error messages to clients while logging detailed errors internally
   • DHide all errors and return a success response even when the operation fails
   Reveal Solution Discussion Select an answer first