API Security and Integration Best Practices CSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is logging API requests important for security?

   • AIt encrypts the API payloads
   • BIt helps in debugging application code
   • CIt provides a record of who accessed what and when, enabling anomaly detection and auditing
   • DIt automatically blocks malicious requests
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why is input validation essential for API security?

   • AIt eliminates the need for authentication
   • BIt ensures that API responses are always in JSON format
   • CIt improves the readability of API documentation
   • DIt prevents attackers from injecting malicious code or data through API parameters
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A developer is building a cloud API that accepts a JSON payload containing a 'username' field. The field is later used in a SQL query. The team wants to prevent SQL injection. Which approach is the most effective?

   • AStore the username in a separate database and query it later
   • BValidate that the username matches a regex pattern
   • CEscape single quotes in the username before building the query
   • DUse parameterized queries or prepared statements
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An internal API is used by multiple backend services. The security team wants to ensure that only authorized services can call the API and that each service is identified. They also want to prevent one service from overwhelming the API. Which mechanism should they use?

   • AUse OAuth2 with user credentials for service-to-service calls.
   • BAllow any request from the internal network without authentication.
   • CIssue a unique API key to each service and configure rate limits per key.
   • DUse a single shared API key for all services.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A public API is being targeted by a distributed denial-of-service (DDoS) attack. The attack uses many distributed IP addresses, making IP-based rate limiting ineffective. The API also must remain available to legitimate users. Which additional control should the team implement?

   • ARequire authentication for all API requests and apply rate limiting per authenticated user.
   • BDisable rate limiting to avoid blocking legitimate users.
   • CIncrease the API server's capacity to absorb the attack.
   • DBlock all traffic from countries where the attack originates.
   Reveal Solution Discussion Select an answer first