API Security and Integration Best Practices CSE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A developer is building an API that accepts file uploads. The API stores the files in cloud storage and later processes them. The security team is concerned about malicious file uploads. Which combination of controls should the developer implement?

   • AOnly check the file extension and rely on the client to send safe files.
   • BAccept any file type and store it in a public bucket for easy sharing.
   • CValidate the file type and size, scan the file for malware, and store it in a private bucket with restricted access.
   • DStore the file in a database as a BLOB without any validation.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is a secure configuration practice when integrating APIs with cloud services?

   • AShare API keys among all team members to simplify access
   • BUse a dedicated secrets management service to store and rotate API keys and credentials
   • CStore API keys and secrets in source code for easy access by developers
   • DDisable logging for any integration that uses sensitive data
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company's API stores sensitive customer data in a cloud database. The data is encrypted at rest using cloud-managed keys. The security team wants to add an additional layer of protection to meet customer requirements. What is the most appropriate approach?

   • AEncrypt the data again in the application layer before storing
   • BUse customer-managed keys (CMK) with AWS KMS or Azure Key Vault
   • CMove the data to a different cloud region
   • DDisable encryption at rest because the cloud provider already secures it
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A healthcare API transmits patient records between a mobile app and a cloud backend. The security policy mandates that data be protected both in transit and at rest. Which configuration should the security team verify?

   • AUse a custom encryption algorithm for all API traffic and store keys in the source code.
   • BOnly encrypt data at rest and allow plaintext HTTP for internal API calls.
   • CTLS 1.2 or higher for all API endpoints and server-side encryption for the database storing patient records.
   • DTLS 1.0 for compatibility with older mobile devices and no encryption for the database.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is a key consideration when logging API requests?

   • AAvoid logging any request details to protect user privacy
   • BMask or redact sensitive information like tokens and personal data in logs
   • CLog all sensitive data such as passwords and tokens to ensure complete records
   • DStore logs in plain text for easy readability
   Reveal Solution Discussion Select an answer first