Web Services Security GWEB Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A public REST API is being overwhelmed by a single client making thousands of requests per second, causing performance degradation for other users. The API uses API keys for authentication. What is the most effective immediate mitigation?

   • AIncrease the server's connection timeout
   • BBlock the client's IP address at the firewall
   • CImplement per-API-key rate limiting with a threshold that matches normal usage patterns
   • DAdd a CAPTCHA to every API request
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company is deploying a new web service that will handle sensitive customer data. The service will be accessed over the internet. The security team requires that all data in transit be encrypted and that the server's identity be verified by clients. Which configuration is necessary?

   • AInstall a valid TLS certificate from a trusted CA and enforce HTTPS-only connections.
   • BEncrypt the payload with a shared symmetric key and send it over HTTP.
   • CUse a self-signed certificate and distribute it to all clients.
   • DUse TLS but disable certificate validation on the client side.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A public REST API is experiencing a denial-of-service attack where a single IP address sends thousands of requests per second. The API also has legitimate users behind a corporate NAT that share a single IP address. Which rate limiting strategy is most appropriate?

   • AApply a strict per-IP rate limit that blocks any IP exceeding 100 requests per minute.
   • BRate limit based on the API key rather than IP address, but allow unlimited anonymous access.
   • CDisable rate limiting entirely to avoid blocking legitimate users.
   • DUse a token bucket algorithm with a high per-IP limit and monitor for anomalies.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is a common technique to implement rate limiting in a web service?

   • ABlocking all requests from IP addresses that have a history of attacks.
   • BEncrypting all requests with a shared secret.
   • CRequiring clients to solve a CAPTCHA for every request.
   • DUsing a token bucket algorithm to allow bursts of requests up to a limit.
   Reveal Solution Discussion Select an answer first