API Security and Integration Best Practices CSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of using OAuth2 in API authentication and authorization?

   • ATo delegate authorization without exposing the user's credentials to the client application
   • BTo encrypt API payloads between client and server
   • CTo allow users to log in with their social media accounts
   • DTo replace API keys with a simpler static token
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security team is conducting a penetration test on a new API. They have a limited time window and must prioritize testing for the most critical vulnerabilities. The API accepts JSON input and uses JWT for authentication. Which testing activity should they prioritize?

   • ATest for injection flaws by sending malicious payloads in JSON fields and test for JWT tampering by modifying the token.
   • BTest only the API's performance under load.
   • CCheck the API's response time for each endpoint.
   • DReview the API's documentation for accuracy.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A cloud API processes credit card data and must comply with PCI DSS. The API uses OAuth2 tokens for authentication. What is the most important control to ensure compliance?

   • AUse short-lived OAuth2 tokens
   • BLog all API requests and responses
   • CRestrict API access to a specific IP range
   • DEncrypt all cardholder data at rest and in transit
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A multinational company's API processes personal data of EU citizens. The legal team requires that the API implementation demonstrate compliance with GDPR, including the ability to provide audit logs and ensure data protection. Which measure should the company implement?

   • AEnable detailed audit logging of all API access and ensure that data is encrypted in transit and at rest.
   • BUse only HTTP to avoid encryption overhead.
   • CDisable logging to minimize the data collected.
   • DStore all logs in a public bucket for transparency.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company exposes a public REST API for its mobile app. The API currently uses long-lived API keys passed in the Authorization header. After a security review, the team decides to implement OAuth2 with short-lived access tokens and refresh tokens. What additional control is most important to prevent token theft from the mobile app?

   • ARotate API keys every 30 days
   • BAdd a custom header with a device fingerprint
   • CStore tokens in the app's local storage and use HTTPS
   • DUse PKCE (Proof Key for Code Exchange) during the OAuth2 authorization flow
   Reveal Solution Discussion Select an answer first