MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

What is the primary goal of security testing in API testing?
a. To ensure API functions as expected
b. To verify API’s security features against potential vulnerabilities
c. To check API response times
d. To test the user interface of the API
Answer: b. To verify API’s security features against potential vulnerabilitiesqaautomation
Which of the following is a common security vulnerability in APIs?
a. SQL Injection
b. Cross-Site Scripting (XSS)
c. Cross-Site Request Forgery (CSRF)
d. All of the above
Answer: d. All of the aboveqaautomation
Which attack can occur if an API does not properly validate user inputs?
a. Cross-Site Scripting (XSS)
b. Denial of Service (DoS)
c. SQL Injection
d. Both a and c
Answer: d. Both a and cqaautomation
What type of vulnerability can occur if an API leaks sensitive information in error messages?
a. Data Injection
b. Information Disclosure
c. XML External Entity (XXE)
d. Broken Object Level Authorization (BOLA)
Answer: b. Information Disclosureqaautomation
What is a recommended method for protecting API data in transit?
a. Use of FTP
b. Use of HTTPS
c. Use of HTTP
d. None of the above
Answer: b. Use of HTTPScurity+2
What type of attack does Cross-Site Request Forgery (CSRF) typically target in API security?
a. It exploits the trust that a site has in the user’s browser
b. It targets the API endpoint to inject malicious code
c. It exploits client-side JavaScript weaknesses
d. It bypasses authentication mechanisms
Answer: a. It exploits the trust that a site has in the user’s browserqaautomation
Which method is commonly used to protect sensitive data in APIs during storage?
a. Encryption
b. Caching
c. Compression
d. Rate Limiting
Answer: a. Encryptionwiz+1
What type of API attack involves sending malicious code through input fields to compromise the server or database?
a. Cross-Site Scripting (XSS)
b. SQL Injection
c. Man-in-the-Middle (MitM)
d. Denial of Service (DoS)
Answer: b. SQL Injectionowasp+1
Which of the following is a valid security mechanism to prevent API key theft?
a. Store the API key in a local text file
b. Use secure methods like OAuth for authentication
c. Embed API keys directly in frontend JavaScript
d. None of the above
Answer: b. Use secure methods like OAuth for authentication42crunch+2
What is the purpose of Rate Limiting in API security?
a. To reduce server costs
b. To prevent Denial of Service (DoS) attacks
c. To speed up API performance
d. To encrypt data
Answer: b. To prevent Denial of Service (DoS) attacksgeeksforgeeks+2
Which tool is commonly used for automated security testing of APIs?
a. OWASP ZAP
b. Postman
c. Burp Suite
d. All of the above
Answer: d. All of the abovegeeksforgeeks+1
What is the primary goal of API authentication?
a. To track API requests
b. To ensure only authorized users access the API
c. To analyze usage patterns
d. To rate limit endpoints
Answer: b. To ensure only authorized users access the APIwiz+2
What is OAuth commonly used for in API security?
a. Data encryption
b. Secure authentication and authorization
c. Rate limiting
d. Data compression
Answer: b. Secure authentication and authorizationfrontegg+2
Which best practice helps prevent broken authentication in APIs?
a. Using hard-coded credentials
b. Implementing multi-factor authentication (MFA)
c. Using basic auth only
d. Avoiding password rotation
Answer: b. Implementing multi-factor authentication (MFA)owasp+1
What does BOLA stand for in API security?
a. Broken Operation Layer Authentication
b. Broken Object Level Authorization
c. Basic Object-Level Authorization
d. Backend Operational Layer Assignment
Answer: b. Broken Object Level Authorizationslainstitute+1
What is an API Gateway used for?
a. Centralizing API requests and security features
b. Encrypting all data automatically
c. Increasing bandwidth
d. Reducing code maintenance
Answer: a. Centralizing API requests and security featureskonghq+2
What security measure helps defend against unauthorized domain access to APIs?
a. Implementing CORS (Cross-Origin Resource Sharing)
b. Using HTTP only
c. Disabling DNSSEC
d. Enabling compression
Answer: a. Implementing CORS (Cross-Origin Resource Sharing)frontegg+1
Which of the following mitigates Man-in-the-Middle (MitM) attacks in API communication?
a. Rate limiting
b. Data encryption
c. Using HTTPS/TLS for secure channel
d. Allowing self-signed certificates
Answer: c. Using HTTPS/TLS for secure channelcurity+2
What security principle is enforced with role-based access control (RBAC)?
a. Principle of Least Privilege
b. Principle of Maximum Security
c. Principle of Unlimited Access
d. Principle of Easy Access
Answer: a. Principle of Least Privilegekonghq+2
Which is a recommended way to handle sensitive API error messages?
a. Disclose all error details to users
b. Provide minimal information, log detailed errors internally
c. Send stack traces in API responses
d. Ignore errors
Answer: b. Provide minimal information, log detailed errors internallywiz+1
What is SQL Injection?
a. Manipulation of SQL queries via user input
b. Encryption of SQL data
c. SQL server crash
d. Automated SQL updates
Answer: a. Manipulation of SQL queries via user inputscribd+2
How does input validation help API security?
a. Prevents malicious data from reaching APIs
b. Decreases server response time
c. Increases available bandwidth
d. Provides logging capabilities
Answer: a. Prevents malicious data from reaching APIsslainstitute+2
What mechanism improves API key safety?
a. Hard-coding keys in source files
b. Rotating and storing keys securely
c. Publishing keys on GitHub
d. Using keys without expiration
Answer: b. Rotating and storing keys securelyfrontegg+1
What vulnerability arises from exposing excessive API data?
a. Data overexposure
b. Compression errors
c. Bandwidth leaks
d. Timeout overload
Answer: a. Data overexposureslainstitute+2
What is mutual TLS (mTLS) used for?
a. Encrypting data between microservices
b. Speeding up data transfer
c. Allowing unauthenticated traffic
d. Disabling encryption
Answer: a. Encrypting data between microserviceswiz
What standard does OWASP API Security Project recommend?
a. OAuth only
b. OpenAPI security schemas and vulnerability testing
c. SSLv2 encryption
d. JSON-formatted passwords
Answer: b. OpenAPI security schemas and vulnerability testingowasp+1
Why should API tokens have short expiration times?
a. To avoid token theft
b. To improve performance
c. To increase bandwidth
d. To allow unlimited access
Answer: a. To avoid token theftgeeksforgeeks+1
What security concept describes preventing unauthorized modification of information?
a. Confidentiality
b. Integrity
c. Availability
d. Scalability
Answer: b. Integrityigmguru+1
Which protocol is recommended for API communication security?
a. HTTP
b. FTP
c. HTTPS/TLS
d. SMTP
Answer: c. HTTPS/TLScurity+2
Which tool is used for real-time monitoring of API activity?
a. SIEM (Security Information & Event Management)
b. IDE
c. Spreadsheet
d. Web browser
Answer: a. SIEM (Security Information & Event Management)konghq+1
Why is input sanitization important for API endpoints?
a. Reduces server performance
b. Prevents injection attacks
c. Decreases usability
d. Increases downtime
Answer: b. Prevents injection attacksslainstitute+2
Which is NOT a recommended security practice for APIs?
a. Storing credentials in plain text
b. Encrypting sensitive data
c. Validating user inputs
d. Using secure authentication
Answer: a. Storing credentials in plain textcurity+2
How can logging help improve API security?
a. Tracks requests for anomaly detection and audit trails
b. Provides server performance insights only
c. Removes authentication
d. Slows down response time
Answer: a. Tracks requests for anomaly detection and audit trailsgeeksforgeeks+2
What is a primary function of an API contract?
a. Documents request/response and security schemas
b. Defines server memory usage
c. Specifies data compression methods
d. Improves logging
Answer: a. Documents request/response and security schemasowasp+1
Why are strong cryptographic algorithms important for API key generation?
a. Ensure keys are not easily guessable
b. Increase page load time
c. Lower bandwidth use
d. Provide colorful logs
Answer: a. Ensure keys are not easily guessablefrontegg+1
What does the “principle of least privilege” in API design mean?
a. Restricting user access to only necessary resources
b. Granting admin permissions to everyone
c. Allowing anonymous access
d. Using hard-coded credentials
Answer: a. Restricting user access to only necessary resourceswiz+1
What is the recommended approach to versioning APIs for security?
a. Use semantic versioning and deprecate insecure versions
b. Always use v1 forever
c. Avoid version control
d. Use the same version for all environments
Answer: a. Use semantic versioning and deprecate insecure versionskonghq
Which vulnerability targets improperly implemented authentication in APIs?
a. Broken Authentication
b. Cross-Site Scripting (XSS)
c. Injection
d. DOS attack
Answer: a. Broken Authenticationslainstitute+1
Which is the best way to perform authorization in APIs?
a. Role-based or resource-based authorization mechanisms
b. Single password for all users
c. Unrestricted access
d. Exposing all endpoints
Answer: a. Role-based or resource-based authorization mechanismsgeeksforgeeks+2
When should API security requirements be considered in the development cycle?
a. At the design phase
b. After deployment
c. At project completion
d. After user complaints
Answer: a. At the design phasefrontegg+1
What is API threat modeling?
a. Evaluating risks and security threats in APIs early in development
b. Increasing API performance
c. Optimizing front-end code
d. Lowering bandwidth
Answer: a. Evaluating risks and security threats in APIs early in developmentwiz+1
How can API endpoints be protected from brute-force attacks?
a. Implement rate limiting and account lockouts
b. Use larger payloads
c. Disable authentication
d. Allow infinite retries
Answer: a. Implement rate limiting and account lockoutskonghq+2
What does “auditing” mean in API cybersecurity?
a. Reviewing and monitoring API transactions for suspicious activity
b. Capturing user details only
c. Deleting logs after each request
d. Disabling monitoring
Answer: a. Reviewing and monitoring API transactions for suspicious activitygeeksforgeeks+2
Which is a risk of not validating API requests?
a. Attackers can send malicious payloads
b. Improved speed
c. Better availability
d. Lower response time
Answer: a. Attackers can send malicious payloadsowasp+2
What should be avoided in API responses for error handling?
a. Exposing stack traces and internal information
b. Returning minimal error details
c. Logging errors internally
d. Providing user-friendly messages
Answer: a. Exposing stack traces and internal informationfrontegg+2
Which protocol is commonly used for API token passing?
a. HTTPS
b. SMTP
c. FTP
d. POP3
Answer: a. HTTPScurity+2
How does centralized OAuth server help API security?
a. Consistent token-based authentication and access control
b. Allows token sharing across apps
c. Requires less encryption
d. Removes access controls
Answer: a. Consistent token-based authentication and access controlcurity+1
What is the purpose of API security linters in IDEs?
a. Proactively uncover source code security issues
b. Increase build times
c. Lower memory usage
d. Format documentation
Answer: a. Proactively uncover source code security issueswiz+1
Which category does OWASP API Security Top 10 target?
a. API-specific vulnerabilities and risks
b. Frontend performance optimizations
c. Data compression standards
d. Database query speed
Answer: a. API-specific vulnerabilities and risksowasp+2
Why should APIs avoid using ‘alg=none’ in JWT token validation?
a. It allows easy token forgery
b. It improves validation speed
c. It ensures tokens never expire
d. It increases key rotation frequency
Answer: a. It allows easy token forgeryfrontegg+1

Blog

Systemethic Technologies

Leave a Reply Cancel reply

Useful links

Other Terms & Policies

Contact Info