API Security and Integration Best Practices CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare API transmits patient records between a cloud backend and a partner's on-premises system. The partner's system does not support TLS 1.3. What is the best way to secure data in transit?

   • AUse plain HTTP because the partner is trusted
   • BEncrypt the data at the application layer before sending
   • CUse TLS 1.3 and require the partner to upgrade
   • DUse TLS 1.2 with strong cipher suites
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which protocol is commonly used to encrypt data in transit for APIs?

   • AIPsec (Internet Protocol Security)
   • BPGP (Pretty Good Privacy)
   • CSSH (Secure Shell)
   • DTLS (Transport Layer Security)
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of penetration testing an API?

   • ATo identify and exploit security vulnerabilities in the API in a controlled manner
   • BTo verify that the API meets performance benchmarks
   • CTo validate that the API documentation is accurate
   • DTo ensure the API is compatible with all web browsers
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization is about to release a new public API. The security team wants to identify vulnerabilities before production. Which testing approach is most comprehensive?

   • ARun a vulnerability scanner on the API's cloud infrastructure
   • BPerform dynamic API penetration testing against a staging environment
   • CRun a static code analysis on the API source code
   • DReview the API documentation for security warnings
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A public API accepts user comments that are later displayed to other users. The security team is concerned about stored XSS attacks. Which input handling strategy should the API implement?

   • AStore the input exactly as received and rely on the client to escape output.
   • BBase64-encode the input before storing it.
   • CValidate that the input matches an expected pattern and sanitize it by stripping or encoding HTML tags.
   • DReject any input that contains a space or special character.
   Reveal Solution Discussion Select an answer first