IncludeHelp_logo
Skip Navigation Links
×

Trending Technologies MCQs

Home » Trending Technologies MCQs

API Security MCQs (Multiple-Choice Questions)

Test your knowledge of API Security with these multiple-choice questions. This collection covers authentication, authorization, API keys, OAuth 2.0, JSON Web Tokens (JWT), rate limiting, input validation, encryption, common API vulnerabilities, security testing, and secure API design.

API Security MCQs

API Security focuses on protecting Application Programming Interfaces (APIs) from unauthorized access, data exposure, abuse, and other security threats. APIs allow applications, services, and systems to exchange information, making their authentication mechanisms, authorization rules, data validation, and communication channels important parts of an organization's security architecture.

Effective API security combines strong identity verification, object-level and function-level authorization, secure transport, input validation, rate limiting, sensitive data protection, logging, and continuous testing. Understanding these controls helps developers, security analysts, API architects, and cybersecurity students design and maintain safer APIs.

List of API Security MCQs

The following API Security MCQs cover fundamental concepts, authentication methods, access control, common vulnerabilities, API gateways, token security, secure communication, monitoring, and practical attack scenarios. Each question includes four options, the correct answer, and an explanation to support technical learning and exam preparation.

1. What is the primary objective of API Security?

  1. To increase the number of API endpoints without access controls
  2. To protect APIs, their data, and their operations from unauthorized access and misuse
  3. To eliminate the need for application testing
  4. To replace all database systems

Answer: B) To protect APIs, their data, and their operations from unauthorized access and misuse

Explanation:

API Security protects the confidentiality, integrity, and availability of API services. It includes authentication, authorization, input validation, secure communication, abuse prevention, and monitoring of suspicious activity.

2. What does an API allow software applications to do?

  1. Communicate and exchange data or functionality through defined interfaces
  2. Operate without any network or software interface
  3. Automatically remove all application vulnerabilities
  4. Guarantee that every request is authorized

Answer: A) Communicate and exchange data or functionality through defined interfaces

Explanation:

An API defines how software components interact. It may expose operations for retrieving data, submitting transactions, or invoking services. Security controls are necessary because an API can expose sensitive information or powerful application functions.

3. What is API authentication?

  1. Encrypting every response with the same password
  2. Limiting the size of a request body
  3. Determining whether a request uses a permitted HTTP method
  4. Verifying the identity or credentials of a client or user

Answer: D) Verifying the identity or credentials of a client or user

Explanation:

Authentication establishes who or what is making an API request. Common approaches include access tokens, API keys, client certificates, and OAuth-based authentication flows. Authentication does not automatically determine what the caller is allowed to do.

4. What is API authorization?

  1. Compressing request payloads
  2. Creating a public API documentation page
  3. Determining which resources and operations an authenticated caller is permitted to access
  4. Assigning a random port to every API request

Answer: C) Determining which resources and operations an authenticated caller is permitted to access

Explanation:

Authorization checks whether a user, application, or service has permission to perform a requested action. An authenticated user may still be prohibited from accessing another user's records or performing administrative operations.

5. Which protocol is commonly used to protect data transmitted between API clients and servers?

  1. TLS
  2. FTP without encryption
  3. Telnet
  4. Plaintext HTTP without transport protection

Answer: A) TLS

Explanation:

Transport Layer Security (TLS) protects data in transit by providing encryption and integrity protection and, when certificates are properly validated, server authentication. HTTPS uses HTTP over TLS and is the standard choice for protecting API traffic.

6. What is the main security risk of exposing an API key in public source code?

  1. The API documentation becomes unreadable
  2. Unauthorized parties may obtain and misuse the credential
  3. The server automatically disables TLS
  4. The API stops accepting JSON requests

Answer: B) Unauthorized parties may obtain and misuse the credential

Explanation:

Publicly exposed API keys may allow attackers to consume services, access data, or perform actions permitted by the key. Keys should be stored securely, scoped appropriately, monitored, and rotated or revoked if exposed.

7. What is the purpose of OAuth 2.0?

  1. To replace every API endpoint with a database table
  2. To encrypt all application data using one shared password
  3. To provide a framework for delegated authorization and controlled access to protected resources
  4. To eliminate the need for access tokens in every implementation

Answer: C) To provide a framework for delegated authorization and controlled access to protected resources

Explanation:

OAuth 2.0 enables a client to obtain limited access to protected resources through access tokens and authorization grants. It is an authorization framework; authentication of end users is commonly handled using an identity layer such as OpenID Connect when needed.

8. What is a JSON Web Token (JWT) commonly used for?

  1. Storing database backups in a compressed format
  2. Replacing all network certificates
  3. Encrypting every HTTP request automatically
  4. Representing claims in a compact token format that can be signed or otherwise protected

Answer: D) Representing claims in a compact token format that can be signed or otherwise protected

Explanation:

JWTs can carry claims about a subject, issuer, audience, and expiration. A signed JWT provides integrity and authenticity when correctly validated, but its payload is not necessarily encrypted. Applications must validate the expected signing algorithm, issuer, audience, and relevant time claims.

9. What is rate limiting in API Security?

  1. Restricting the number of requests a client can make within a defined period or policy window
  2. Allowing every client unlimited requests
  3. Disabling API authentication during peak traffic
  4. Increasing the size of every response automatically

Answer: A) Restricting the number of requests a client can make within a defined period or policy window

Explanation:

Rate limiting helps control excessive requests, reduce resource abuse, and protect service availability. Limits may be applied per client, account, token, endpoint, or other criteria, with thresholds adjusted to legitimate usage patterns.

10. What is Broken Object Level Authorization (BOLA)?

  1. A failure to encrypt a database backup
  2. A vulnerability in which an API fails to properly verify whether the caller may access a specific object
  3. A method for improving API response speed
  4. A problem caused only by invalid JSON formatting

Answer: B) A vulnerability in which an API fails to properly verify whether the caller may access a specific object

Explanation:

BOLA occurs when an API checks that a caller is authenticated but does not adequately verify access to the requested object. For example, a user might change a record identifier and retrieve another user's private information.

11. What is Broken Function Level Authorization (BFLA)?

  1. A vulnerability caused only by expired TLS certificates
  2. A failure to validate JSON syntax
  3. A weakness that allows callers to access functions or operations beyond their assigned permissions
  4. A technique for compressing API responses

Answer: C) A weakness that allows callers to access functions or operations beyond their assigned permissions

Explanation:

BFLA occurs when an API does not properly enforce permissions for particular functions. For example, a regular user might be able to invoke an administrative endpoint if the server fails to check the caller's privileges.

12. What is the primary purpose of input validation in API Security?

  1. To guarantee that every request is made by a trusted person
  2. To eliminate the need for authorization checks
  3. To increase the number of accepted request formats without restrictions
  4. To verify that incoming data conforms to expected types, formats, ranges, and business rules

Answer: D) To verify that incoming data conforms to expected types, formats, ranges, and business rules

Explanation:

Input validation rejects malformed or unexpected data before it can cause harmful behavior. APIs should validate request fields, lengths, allowed values, and business constraints, while also using safe database and command-handling techniques.

13. What is SQL injection in the context of an API?

  1. An attack in which untrusted input changes the meaning of a database query
  2. A method for encrypting database connections
  3. A way to improve API documentation
  4. A technique for limiting requests per second

Answer: A) An attack in which untrusted input changes the meaning of a database query

Explanation:

SQL injection can occur when an application constructs database queries unsafely using untrusted input. Parameterized queries, appropriate database permissions, and input validation help reduce the risk.

14. Why should APIs avoid returning unnecessary sensitive information?

  1. Because every response must contain every database column
  2. Because excessive data exposure can reveal personal, financial, or internal information to unauthorized parties
  3. Because API clients cannot process structured responses
  4. Because removing unnecessary fields disables authentication

Answer: B) Because excessive data exposure can reveal personal, financial, or internal information to unauthorized parties

Explanation:

APIs should return only the data needed for the intended operation. Explicit response schemas and field-level access controls reduce the chance of exposing sensitive attributes such as private identifiers, internal flags, or confidential account information.

15. What is the purpose of an API gateway?

  1. To replace every application database
  2. To store every user password in plaintext
  3. To provide a common entry point for routing, policy enforcement, traffic management, and other API functions
  4. To guarantee that backend services contain no vulnerabilities

Answer: C) To provide a common entry point for routing, policy enforcement, traffic management, and other API functions

Explanation:

An API gateway can centralize functions such as request routing, authentication integration, rate limiting, and access logging. It does not replace the need for authorization and input validation within backend services.

16. What does Cross-Origin Resource Sharing (CORS) control?

  1. The encryption algorithm used by every database
  2. The number of users permitted to register for a service
  3. The permissions assigned to operating system processes
  4. Which browser origins may access responses under the browser's cross-origin rules

Answer: D) Which browser origins may access responses under the browser's cross-origin rules

Explanation:

CORS is a browser-enforced mechanism that allows servers to specify which origins may access certain cross-origin responses. It is not a replacement for authentication or authorization and does not prevent non-browser clients from making requests.

17. Why should an API validate the audience claim in an access token when applicable?

  1. To ensure that the token is intended for the API or resource receiving it
  2. To determine the physical location of the client
  3. To guarantee that the token's payload is encrypted
  4. To allow tokens issued for any service to be accepted

Answer: A) To ensure that the token is intended for the API or resource receiving it

Explanation:

Audience validation helps prevent a token issued for one service from being incorrectly accepted by another. APIs should validate the claims and cryptographic properties required by their token format and security design.

18. What is the purpose of token expiration?

  1. To guarantee that a compromised token can never be used
  2. To limit the period during which a token is accepted as valid
  3. To increase the permissions of the token holder
  4. To remove the need for secure token storage

Answer: B) To limit the period during which a token is accepted as valid

Explanation:

Expiration limits the useful lifetime of a token, reducing the window in which a stolen token may be abused. It does not replace revocation, secure storage, appropriate scopes, or validation of issuer and audience.

19. What is the primary purpose of mutual TLS (mTLS) in API communication?

  1. To disable server certificate validation
  2. To replace all authorization checks
  3. To require both communicating parties to present and validate certificates according to the configured trust model
  4. To guarantee that application data is safe from all forms of attack

Answer: C) To require both communicating parties to present and validate certificates according to the configured trust model

Explanation:

Mutual TLS can authenticate both client and server at the transport layer. It is useful for service-to-service communication, but applications may still need authorization rules to determine which operations an authenticated client can perform.

20. What is the main risk of using weak or predictable API credentials?

  1. API responses will always become smaller
  2. The API will automatically stop supporting HTTPS
  3. Every request will be rate-limited correctly
  4. Attackers may guess or obtain the credentials and gain unauthorized access

Answer: D) Attackers may guess or obtain the credentials and gain unauthorized access

Explanation:

Weak or predictable credentials make unauthorized access easier. Strong authentication, credential rotation when appropriate, secret storage, monitoring, and protection against brute-force attempts help mitigate this risk.

21. What is the purpose of API request size limits?

  1. To reduce the risk of resource exhaustion caused by excessively large request payloads
  2. To guarantee that every request is legitimate
  3. To replace all authorization checks
  4. To ensure that every client can upload unlimited data

Answer: A) To reduce the risk of resource exhaustion caused by excessively large request payloads

Explanation:

Request size limits help protect memory, parsing, storage, and processing resources. Suitable limits should reflect legitimate application needs and be combined with timeouts, rate limiting, and other abuse-prevention controls.

22. What is Broken Object Property Level Authorization?

  1. A failure to encrypt every API response
  2. A weakness that allows unauthorized reading or modification of particular object properties
  3. A problem that occurs only when an API has no documentation
  4. A method for assigning IP addresses to services

Answer: B) A weakness that allows unauthorized reading or modification of particular object properties

Explanation:

This vulnerability can expose sensitive fields or permit changes to properties that a caller should not control. APIs should enforce field-level permissions and use explicit input and output schemas rather than trusting client-supplied object properties.

23. Why should API error messages avoid exposing internal implementation details?

  1. Because every error must return a successful status code
  2. Because detailed errors always improve access control
  3. Because stack traces, database details, and internal paths can help attackers discover weaknesses
  4. Because API clients cannot process error responses

Answer: C) Because stack traces, database details, and internal paths can help attackers discover weaknesses

Explanation:

Error responses should provide enough information for clients to understand a failure without unnecessarily exposing internal implementation details. Detailed diagnostic information should be recorded in appropriately protected server-side logs.

24. What is the purpose of schema validation for an API request?

  1. To ensure that every request originates from a particular country
  2. To guarantee that the request is authorized
  3. To replace TLS encryption
  4. To check that the request structure, fields, types, and constraints conform to an expected schema

Answer: D) To check that the request structure, fields, types, and constraints conform to an expected schema

Explanation:

Schema validation helps reject malformed or unexpected input before processing. It can verify required fields, data types, allowed values, and structural constraints, but it does not replace business-rule validation or authorization checks.

25. What is the purpose of an API security test?

  1. To identify weaknesses in authentication, authorization, input handling, configuration, and other security controls
  2. To guarantee that an API will never be attacked
  3. To increase the number of undocumented endpoints
  4. To remove all API logging

Answer: A) To identify weaknesses in authentication, authorization, input handling, configuration, and other security controls

Explanation:

API security testing evaluates how an API responds to malicious, unexpected, or unauthorized requests. Testing may include automated scanning, authorization tests, fuzzing, code review, and controlled penetration testing.

26. What is the purpose of API rate limiting when defending against brute-force attacks?

  1. To allow unlimited password attempts
  2. To restrict repeated requests and reduce the rate at which an attacker can guess credentials
  3. To disable all failed-login logging
  4. To give anonymous users administrative permissions

Answer: B) To restrict repeated requests and reduce the rate at which an attacker can guess credentials

Explanation:

Rate limits can slow repeated attempts against authentication endpoints. They should be combined with suitable authentication controls, abuse detection, monitoring, and account protections because attackers may distribute requests across multiple sources.

27. What is the purpose of API versioning?

  1. To guarantee that every API request is encrypted
  2. To eliminate all outdated endpoints automatically
  3. To manage changes to API contracts while supporting compatibility and controlled migration
  4. To replace authorization rules with version numbers

Answer: C) To manage changes to API contracts while supporting compatibility and controlled migration

Explanation:

Versioning helps clients and service providers manage API changes. Security teams should also track older versions because deprecated endpoints may retain vulnerabilities or weaker access controls if they remain available without maintenance.

28. Why should deprecated API endpoints be reviewed and retired when appropriate?

  1. They automatically improve the security of all newer endpoints
  2. They cannot be accessed by attackers
  3. They eliminate the need for API documentation
  4. They may retain outdated functionality, weak controls, or vulnerabilities that are no longer maintained

Answer: D) They may retain outdated functionality, weak controls, or vulnerabilities that are no longer maintained

Explanation:

Older API versions can become security blind spots when teams focus only on current endpoints. Inventory management, access monitoring, migration planning, and controlled retirement help reduce the exposure of forgotten or unsupported APIs.

29. What is the main purpose of an API inventory?

  1. To identify known APIs, their owners, versions, data access, and exposure so they can be managed and secured
  2. To guarantee that no undocumented endpoint exists
  3. To replace all application security testing
  4. To store API passwords in a public document

Answer: A) To identify known APIs, their owners, versions, data access, and exposure so they can be managed and secured

Explanation:

An API inventory helps organizations understand their attack surface, including public, internal, and deprecated endpoints. Keeping the inventory current supports risk assessment, access review, vulnerability management, and retirement of unnecessary APIs.

30. What is mass assignment in API security?

  1. A process for assigning API requests to different servers
  2. A vulnerability in which client-supplied fields are bound to internal object properties without adequate restrictions
  3. A method for compressing JSON responses
  4. A technique for encrypting API keys

Answer: B) A vulnerability in which client-supplied fields are bound to internal object properties without adequate restrictions

Explanation:

Mass assignment can allow a caller to change sensitive properties, such as account roles or approval states, by submitting unexpected fields. Explicit request models, field allowlists, and server-side authorization checks help prevent this weakness.

31. Why is server-side authorization essential even when an application hides restricted buttons in its user interface?

  1. Because hidden buttons automatically disable API endpoints
  2. Because user interfaces are the only reliable authorization mechanism
  3. Because attackers can call API endpoints directly without using the intended interface
  4. Because authorization checks prevent all network failures

Answer: C) Because attackers can call API endpoints directly without using the intended interface

Explanation:

Client-side controls improve usability but cannot enforce access permissions securely on their own. The API server must verify each request's permissions and ensure that the caller is authorized for the requested resource and operation.

32. What is the purpose of logging API security events?

  1. To store all passwords and access tokens in plaintext
  2. To eliminate the need for incident response
  3. To guarantee that every attack is prevented
  4. To support monitoring, investigation, auditing, and detection of suspicious activity

Answer: D) To support monitoring, investigation, auditing, and detection of suspicious activity

Explanation:

Security logs can record authentication failures, authorization denials, unusual traffic patterns, and administrative changes. Sensitive credentials and unnecessary personal data should be excluded or appropriately protected to prevent logs from becoming another source of exposure.

33. What is the security purpose of the HTTP Strict-Transport-Security (HSTS) header?

  1. To instruct supporting browsers to use HTTPS for a site for a specified period
  2. To grant API clients administrator permissions
  3. To disable all certificate validation
  4. To encrypt application data stored in a database automatically

Answer: A) To instruct supporting browsers to use HTTPS for a site for a specified period

Explanation:

HSTS tells supporting browsers to access a domain using HTTPS for the configured period. It helps reduce certain downgrade and insecure-transport risks for browser-based access but does not replace TLS configuration or server-side API security controls.

34. What is the main purpose of an API security gateway policy that blocks unsupported HTTP methods?

  1. To ensure that every HTTP method is accepted
  2. To reduce exposure by allowing only the methods required by the API contract
  3. To eliminate the need for authorization
  4. To convert every request into an unrestricted administrative operation

Answer: B) To reduce exposure by allowing only the methods required by the API contract

Explanation:

Restricting HTTP methods reduces unintended operations and can prevent unnecessary exposure of functionality. The backend must still enforce permissions and validate requests, since an allowed method can also be abused if its authorization checks are weak.

35. Why should API clients validate TLS certificates?

  1. To ensure that every response contains valid JSON
  2. To replace all authorization rules
  3. To help verify the server's identity and protect against connections to impersonating endpoints
  4. To guarantee that the server's application code contains no vulnerabilities

Answer: C) To help verify the server's identity and protect against connections to impersonating endpoints

Explanation:

Certificate validation helps clients verify that they are communicating with the intended server through a trusted certificate chain and matching hostname. Disabling validation can expose API traffic to interception or impersonation attacks.

36. What is the purpose of a Web Application Firewall (WAF) when protecting APIs?

  1. To replace all API authentication mechanisms
  2. To guarantee that every request is authorized for the requested object
  3. To ensure that all backend code is free of security defects
  4. To inspect HTTP traffic and apply rules that help detect or block certain malicious request patterns

Answer: D) To inspect HTTP traffic and apply rules that help detect or block certain malicious request patterns

Explanation:

A WAF can help detect and block some attacks against HTTP-based applications and APIs. It is a defense-in-depth control, not a substitute for secure application design, robust authorization, safe data handling, or API-specific testing.

37. What is the purpose of a refresh token in an OAuth-based system?

  1. To obtain a new access token when permitted, without requiring the user to repeat the full authorization process each time
  2. To grant every client unlimited access to all APIs
  3. To replace the resource server's authorization checks
  4. To make all API requests anonymous

Answer: A) To obtain a new access token when permitted, without requiring the user to repeat the full authorization process each time

Explanation:

Refresh tokens can be used to obtain new access tokens under the authorization server's rules. They are sensitive credentials and should be stored securely, protected against replay where appropriate, and revoked when compromise or account changes require it.

38. What is the purpose of scopes in OAuth 2.0?

  1. To specify the physical network location of an API server
  2. To represent the range of access or permissions requested or granted to a client
  3. To guarantee that every token is encrypted
  4. To replace the need for token validation

Answer: B) To represent the range of access or permissions requested or granted to a client

Explanation:

OAuth scopes can limit the types of access granted to a client, such as reading a resource or managing a specific service. APIs must enforce the relevant permissions rather than assuming that possession of a valid token authorizes every operation.

39. What is the purpose of a negative security test for an API?

  1. To confirm only that valid requests return successful responses
  2. To measure the color of the API documentation
  3. To verify how the API handles invalid, malformed, unauthorized, or unexpected requests
  4. To guarantee that the API cannot experience downtime

Answer: C) To verify how the API handles invalid, malformed, unauthorized, or unexpected requests

Explanation:

Negative testing checks whether security controls reject requests that should not succeed. It can reveal weak authorization, inadequate validation, information leakage, and unexpected application behavior when inputs or permissions are invalid.

40. What is the purpose of a request correlation ID in API operations?

  1. To grant the caller additional permissions
  2. To encrypt every request body automatically
  3. To replace all authentication tokens
  4. To help trace related requests and operations across services and logs

Answer: D) To help trace related requests and operations across services and logs

Explanation:

A correlation ID can link events from an API gateway, application services, and downstream systems. This helps teams investigate failures and suspicious activity across distributed components. IDs should not be treated as authentication credentials or secret values.

41. What is the purpose of a content security policy (CSP) in a web application that uses APIs?

  1. To control which sources the browser may load certain types of content from, helping mitigate some content injection attacks
  2. To authorize every server-side API request automatically
  3. To encrypt all data stored in backend databases
  4. To replace all API gateway policies

Answer: A) To control which sources the browser may load certain types of content from, helping mitigate some content injection attacks

Explanation:

Content Security Policy is a browser security mechanism that restricts sources for scripts and other resources. It can help reduce the impact of certain cross-site scripting attacks, but it does not replace server-side API authorization or input handling.

42. Why should an API enforce pagination limits on collection endpoints?

  1. To guarantee that no unauthorized data can ever be accessed
  2. To limit excessive data retrieval and reduce resource consumption from unusually large queries
  3. To disable all filtering capabilities
  4. To ensure that every request returns the entire database

Answer: B) To limit excessive data retrieval and reduce resource consumption from unusually large queries

Explanation:

Pagination limits restrict the number of records returned in one request. They help control resource usage and excessive data extraction, but the API must still enforce authorization for every returned record and apply appropriate query limits.

43. What is the purpose of protecting an API against server-side request forgery (SSRF)?

  1. To ensure that every request uses a shorter URL
  2. To disable all outgoing network traffic in every application
  3. To prevent attackers from manipulating server-side requests to reach unauthorized internal or external resources
  4. To replace all input validation with API keys

Answer: C) To prevent attackers from manipulating server-side requests to reach unauthorized internal or external resources

Explanation:

SSRF can occur when an application fetches a user-controlled URL without adequate restrictions. Defenses include validating destinations, restricting outbound network access, blocking access to sensitive internal services, and carefully handling redirects and DNS resolution.

44. Why should API security teams monitor unusual changes in request volume?

  1. Because every increase in traffic proves that a data breach has occurred
  2. Because normal API clients must never make repeated requests
  3. Because request volume is unrelated to security
  4. Because sudden spikes or unusual patterns may indicate abuse, automated attacks, scraping, or denial-of-service activity

Answer: D) Because sudden spikes or unusual patterns may indicate abuse, automated attacks, scraping, or denial-of-service activity

Explanation:

Traffic monitoring helps identify anomalous request patterns and potential service abuse. Teams should correlate volume changes with authentication, client identity, endpoint behavior, and operational events before deciding whether to throttle or block traffic.

45. What is the purpose of a secure API deprecation process?

  1. To notify affected consumers, plan migration, monitor usage, and retire unsupported endpoints in a controlled manner
  2. To leave every old endpoint active indefinitely without monitoring
  3. To remove API authentication before retiring a version
  4. To guarantee that no client will ever require migration

Answer: A) To notify affected consumers, plan migration, monitor usage, and retire unsupported endpoints in a controlled manner

Explanation:

A controlled deprecation process reduces disruption while limiting the exposure of outdated endpoints. Organizations should identify affected clients, communicate timelines, provide secure migration options, and verify that retired endpoints are no longer accessible as intended.

46. What should a developer do if an API access token is accidentally committed to a public repository?

  1. Leave it unchanged because repository history is public
  2. Revoke or rotate the exposed token, investigate possible misuse, and remove the secret from active code and future builds
  3. Publish additional copies of the token to simplify testing
  4. Disable API logging to hide the exposure

Answer: B) Revoke or rotate the exposed token, investigate possible misuse, and remove the secret from active code and future builds

Explanation:

A publicly exposed token should be treated as compromised. Revoking or rotating it prevents further use of that credential, while reviewing logs helps identify possible misuse. The repository and build process should also be corrected to prevent future secret exposure.

47. What is the main benefit of an API security testing pipeline in continuous integration and continuous delivery (CI/CD)?

  1. It guarantees that every release is free from vulnerabilities
  2. It eliminates the need for production monitoring
  3. It helps identify security defects earlier by running relevant checks during development and release processes
  4. It automatically grants all developers production administrator access

Answer: C) It helps identify security defects earlier by running relevant checks during development and release processes

Explanation:

Integrating security tests into CI/CD can detect issues before deployment. Depending on the pipeline, checks may include dependency scanning, static analysis, API schema validation, secret detection, and tests for authentication and authorization weaknesses.

48. Why is object-level authorization testing important for APIs?

  1. To confirm that a caller cannot access another user's objects merely by changing an identifier
  2. To ensure that every resource has a publicly accessible identifier
  3. To replace all API authentication checks
  4. To guarantee that database queries are always fast

Answer: A) To confirm that a caller cannot access another user's objects merely by changing an identifier

Explanation:

Object-level authorization tests verify that the API checks permissions for the specific resource being requested. Testing with different users and resource identifiers can reveal BOLA vulnerabilities that ordinary authentication tests may miss.

49. Which sequence best represents a secure API request-processing workflow?

  1. Accept every request, execute its operation, and check permissions only after returning the data
  2. Validate the request structure, authenticate the caller, enforce authorization, safely process the operation, and log relevant security events
  3. Return all database fields before checking the access token
  4. Disable validation whenever a request comes from a known IP address

Answer: B) Validate the request structure, authenticate the caller, enforce authorization, safely process the operation, and log relevant security events

Explanation:

A secure request-processing workflow validates inputs, verifies the caller's identity, checks permissions for the requested operation and resource, and processes data safely. Logging appropriate security events supports detection and investigation. The exact ordering of checks can vary by architecture, but authorization must be enforced before protected operations or data are exposed.

50. An online shopping API allows authenticated customers to retrieve order details using an endpoint such as /api/orders/1045. During testing, a customer changes the order identifier to 1046 and receives another customer's address and order information. Authentication is working correctly, and both requests return HTTP 200. What is the most appropriate security fix?

  1. Hide the order identifier from the browser interface without changing the backend
  2. Increase the length of all order identifiers and keep the existing authorization logic
  3. Check that the caller is authenticated, then authorize access to each requested order based on ownership or an explicitly permitted role before returning its data
  4. Return every customer's order details only when the request uses HTTPS

Answer: C) Check that the caller is authenticated, then authorize access to each requested order based on ownership or an explicitly permitted role before returning its data

Explanation:

This scenario demonstrates Broken Object Level Authorization (BOLA). The API verifies the customer's identity but fails to confirm that the customer is allowed to access the particular order. The backend must enforce object-level permissions for every request before returning the order information. Using unpredictable identifiers can provide an additional layer of defense, but it does not replace authorization. HTTPS protects data in transit but cannot correct an access-control vulnerability in the application.

Comments and Discussions!

Load comments ↻



Top MCQs
Top Programs/Examples
Top Tutorials
About
Student's Section
Subscribe

Copyright © 2026 www.includehelp.com. All rights reserved.