API Security and Integration Best Practices CSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a key aspect of organizational governance for APIs?

   • AUsing the same API key for all internal services
   • BAllowing each team to set its own security standards independently
   • CDefining policies for API creation, access control, and data handling
   • DAvoiding documentation of API changes to reduce overhead
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is it important for API implementations to comply with regulations such as GDPR?

   • ATo protect personal data and avoid legal penalties
   • BTo reduce the number of API versions needed
   • CTo allow the API to be used in any country without restrictions
   • DTo ensure the API is fast enough for all users
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SaaS provider is deprecating an old version of its public API. The provider wants to give customers time to migrate while ensuring that security patches are applied to the new version. Which approach should the provider take?

   • AImmediately shut down the old version to force customers to upgrade.
   • BAnnounce a deprecation schedule, maintain the old version with critical security patches during a transition period, and then retire it.
   • CRedirect all old-version traffic to the new version without notifying customers.
   • DKeep the old version running indefinitely without updates to avoid breaking integrations.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An API provider has multiple versions of an API in production. Version 2 is fully supported, while version 1 is deprecated but still active. A critical security vulnerability is discovered in version 1 that cannot be backported. What is the best course of action?

   • AImmediately disable version 1 and force all clients to version 2
   • BAnnounce a short deprecation window and disable version 1 after that period
   • CApply a Web Application Firewall (WAF) rule to mitigate the vulnerability in version 1
   • DKeep version 1 running but add a warning header to responses
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is exposing an API to external partners. The security team wants to ensure that all traffic is encrypted and that the API's TLS certificate is valid and trusted. Which action should they take?

   • AAllow HTTP and rely on the partners to use a VPN.
   • BUse TLS 1.0 to maximize compatibility with partners.
   • CUse a self-signed certificate and disable certificate validation on the client side.
   • DUse a certificate from a public CA and enforce TLS 1.2 or higher on the API endpoint.
   Reveal Solution Discussion Select an answer first