A security analyst is investigating a potential breach of a customer data API. The API uses OAuth2 and JWT. The analyst needs to determine whether a specific user accessed a particular resource during a given time window. Which log data would be most useful?

Authorization server logs that show when tokens were issued.

Network firewall logs that show source IP addresses.

Database query logs that show SQL statements.

API gateway logs that include the JWT subject, requested URI, timestamp, and response status.

What is the purpose of encrypting sensitive data at rest for APIs?

To protect data stored in databases or files from unauthorized access if the storage is compromised

To ensure data is only accessible from within the cloud provider's network

To comply with API versioning requirements

A SaaS provider is deprecating API v1, which has known security vulnerabilities. Many customers still use v1. What is the most secure deprecation strategy?

Immediately shut down v1 to force migration

Redirect v1 traffic to v2 without telling customers

Keep v1 running indefinitely to avoid customer disruption

Announce a deprecation timeline, provide migration guides, and disable v1 after a grace period

What does input sanitization typically involve?

Encrypting all API requests with a public key

Removing or encoding dangerous characters from user-supplied data

Converting all input to uppercase for consistency

Storing all input in a separate database for auditing

Which of the following is a common security risk that APIs face in cloud environments?

Using JSON instead of XML for payloads

Implementing OAuth2 for authorization

Excessive use of TLS for all API communications

Injection attacks such as SQL injection or command injection

EC-CouncilCloud Security Essentials

Domain 5Objective 4

API Security and Integration Best Practices CSE Practice Questions (Page 6)

Part of the Application Security in the Cloud domain, which makes up ~16% of our current practice bank.

57questions here

12free pages

10concepts

10 Concepts in This Objective

API Security Fundamentals
Authentication and Authorization for APIs
API Data Validation and Input Sanitization
API Rate Limiting and Throttling
API Logging and Monitoring
API Encryption and Secure Communication
API Versioning and Lifecycle Management
Integration Best Practices
API Security Testing
Compliance and Governance for APIs

Questions 26–30

26application · medium
A security analyst is investigating a potential breach of a customer data API. The API uses OAuth2 and JWT. The analyst needs to determine whether a specific user accessed a particular resource during a given time window. Which log data would be most useful?
Select an answer first
27foundation · easy
What is the purpose of encrypting sensitive data at rest for APIs?
Select an answer first
28application · medium
A SaaS provider is deprecating API v1, which has known security vulnerabilities. Many customers still use v1. What is the most secure deprecation strategy?
Select an answer first
29foundation · easy
What does input sanitization typically involve?
Select an answer first
30foundation · easy
Which of the following is a common security risk that APIs face in cloud environments?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.