Perform Secure Interface Design CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is it important to evaluate API weaknesses when designing a protocol?

   • AAPIs are only used for internal communication and do not need security
   • BAPIs are stateless and therefore immune to session attacks
   • CAPIs are a common attack surface, and insecure design can lead to data breaches
   • DAPIs automatically validate all input, so no additional checks are needed
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which technique is commonly used to identify threats in a protocol design?

   • ARunning a vulnerability scanner on the final code
   • BCreating data flow diagrams and applying STRIDE to each element
   • CReviewing the protocol's user documentation
   • DMeasuring the protocol's latency under load
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the main security benefit of using an out-of-band management channel?

   • AIt allows any user to access management functions from the production network
   • BIt increases the speed of production data transfers
   • CIt isolates administrative access from production traffic, reducing exposure to attacks
   • DIt eliminates the need for encryption on management protocols
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A team is designing a new API for a multi-tenant SaaS application. The API will be used by external partners to integrate with the application. The team must ensure that the API is secure against common vulnerabilities while also providing a good developer experience. Which design choice best balances security and usability?

   • AUse OAuth 2.0 with scopes and short-lived access tokens.
   • BUse session-based authentication with a long timeout for convenience.
   • CUse API keys for authentication and require them in the request header.
   • DUse HTTP Basic authentication over HTTPS.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company exposes a public API for uploading files. The API has been experiencing abuse from automated scripts that upload large files repeatedly, consuming server resources. Which mitigation is most effective to address this issue?

   • AIncrease the server's memory and storage capacity.
   • BRemove authentication from the API to reduce friction for legitimate users.
   • CImplement rate limiting per API key and per IP address.
   • DUse a CAPTCHA on every API request.
   Reveal Solution Discussion Select an answer first