Web Communications ISE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A developer is building a RESTful API for a fleet of smart locks. The API must allow an admin to update the lock's firmware version and also change the lock's name. Which pair of HTTP methods should be used for these two operations?

   • ADELETE for firmware update and PUT for name change
   • BPUT for firmware update and PATCH for name change
   • CPOST for firmware update and PUT for name change
   • DGET for firmware update and POST for name change
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An IoT platform team is choosing a data format for device telemetry sent over constrained networks. The devices have limited memory and bandwidth. Which format is most appropriate?

   • AJSON with human-readable keys
   • BBinary format such as CBOR or MessagePack
   • CPlain text with comma-separated values
   • DXML with a schema definition
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which data format is known for its verbose, self-descriptive markup structure and is often used in legacy systems, but can be less efficient than JSON for IoT due to larger payload sizes?

   • AProtobuf
   • BJSON
   • CYAML
   • DXML
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A developer is building a REST API for a fleet of smart locks. The API must allow a mobile app to lock and unlock doors. Which combination of practices is most appropriate for securing the API?

   • AUse HTTPS but allow any client with the API URL to send requests.
   • BUse HTTP for speed and rely on the mobile app's local storage for credentials.
   • CUse HTTPS, require an API key or OAuth token, and validate all input.
   • DUse HTTPS and accept XML payloads without validation to reduce parsing overhead.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security auditor is reviewing an IoT API that uses HTTPS and API keys. The auditor finds that the API key is transmitted in the URL query string. What is the primary risk and what is the best mitigation?

   • AThe key may be logged by proxies or servers; move the key to the Authorization header.
   • BThe key is too short; use a longer key.
   • CThe key should be sent as a cookie.
   • DThe key is encrypted by HTTPS, so there is no risk.
   Reveal Solution Discussion Select an answer first