NEW
Font size
S
M
L
XL
Worksheets03 Secure Coding APIs
Total questions: 50
Worksheet time: 25mins
Name
Class
Date
1.
What is the main purpose of input validation?
a)
Improve UI
b)
Ensure data matches expected rules
c)
Encrypt data
d)
Speed up APIs
2.
An API only validates input in the browser. What is the main risk?
a)
Performance issues
b)
Validation can be bypassed
c)
Browser incompatibility
d)
Logging failure
3.
Why is allowlisting safer than denylisting?
a)
Easier to code
b)
Accepts only known safe values
c)
Faster execution
d)
Uses hashing
4.
An API blocks only known bad patterns. What approach is being used?
a)
Allowlisting
b)
Denylisting
c)
Sanitization
d)
Encryption
5.
What is ReDoS?
a)
Redirect-based attack
b)
Regular Expression Denial of Service
c)
Remote Data Overwrite
d)
Request Duplication
6.
An attacker sends crafted input that freezes the API CPU. Likely cause?
a)
SQL Injection
b)
ReDoS
c)
CSRF
d)
MITM
7.
What is mass assignment?
a)
Multiple DB writes
b)
Automatic binding of request fields
c)
API versioning
d)
Log flooding
8.
An API accepts all JSON fields automatically. Best mitigation?
a)
Encode JSON
b)
Explicitly define allowed fields
c)
Log requests
d)
Encrypt input
9.
What does input sanitization do?
a)
Encrypts data
b)
Removes or encodes unsafe characters
c)
Hashes passwords
d)
Logs requests
10.
Valid input is reused in HTML output. What is required?
a)
Encryption
b)
HTML encoding
c)
Hashing
d)
Logging
11.
What attack does HTML encoding help prevent?
a)
SQL Injection
b)
XSS
c)
CSRF
d)
DDoS
12.
User input containing <script> is rendered in a page. What went wrong?
a)
Missing encryption
b)
Missing encoding
c)
Missing hashing
d)
Missing logging
13.
What is OAuth 2.0 primarily used for?
a)
Authentication
b)
Authorization
c)
Encryption
d)
Auditing
14.
A third-party app asks for user passwords. What should be used instead?
a)
Encryption
b)
OAuth 2.0
c)
Hashing
d)
Cookies
15.
What does OpenID Connect add to OAuth 2.0?
a)
Logging
b)
Identity verification
c)
Encryption
d)
Token revocation
16.
An API knows what a user can do but not who they are. What is missing?
a)
TLS
b)
OpenID Connect
c)
HSTS
d)
RBAC
17.
What is an access token?
a)
Long-term secret
b)
Short-lived authorization token
c)
Password
d)
Session ID
18.
A stolen token gives access for months. What should be changed?
a)
Use cookies
b)
Shorten token lifetime
c)
Disable OAuth
d)
Add logging
19.
What is a refresh token used for?
a)
Encrypt data
b)
Obtain new access tokens
c)
Validate input
d)
Log activity
20.
Refresh tokens are stored in URLs. What is the risk?
a)
Performance
b)
Token leakage
c)
Encoding errors
d)
Cache miss
21.
What does encryption at rest protect?
a)
Network traffic
b)
Stored data
c)
API endpoints
d)
Logs only
22.
Sensitive data is stored in plaintext in a database. Best fix?
a)
Logging
b)
Encrypt data at rest
c)
Hash usernames
d)
Use HTTPS
23.
Which standard is recommended for encrypting stored data?
a)
DES
b)
AES-256
c)
MD5
d)
Base64
24.
Why should passwords be hashed instead of encrypted?
a)
Easier recovery
b)
Hashing is irreversible
c)
Faster login
d)
Smaller size
25.
Passwords are stored using MD5. What should be done?
a)
Add salt only
b)
Use strong password hashing
c)
Encrypt passwords
d)
Shorten passwords
26.
What does TLS protect?
a)
Stored data
b)
Data in transit
c)
Backups
d)
Logs
27.
An API uses HTTP instead of HTTPS. What is the main risk?
a)
UI issues
b)
Data interception
c)
Slower responses
d)
Token expiration
28.
Why should old TLS versions be disabled?
a)
Compatibility
b)
Known vulnerabilities
c)
Performance
d)
Browser limits
29.
What does HMAC provide?
a)
Confidentiality
b)
Integrity
c)
Availability
d)
Compression
30.
Message integrity is required. What should be used?
a)
Encryption
b)
HMAC
c)
Logging
d)
Hashing alone
31.
What does HSTS enforce?
a)
Encryption at rest
b)
HTTPS-only communication
c)
Token rotation
d)
RBAC
32.
Users access an API over HTTP after first visit. What is missing?
a)
TLS
b)
HSTS
c)
OAuth
d)
Logging
33.
What is the principle of least privilege?
a)
Full access
b)
Minimum required permissions
c)
Shared accounts
d)
No permissions
34.
A service account has full admin rights unnecessarily. What principle is violated?
a)
Integrity
b)
Least privilege
c)
Availability
d)
Confidentiality
35.
What is RBAC?
a)
Encryption method
b)
Role-based access control
c)
Logging strategy
d)
API gateway
36.
What is Software Composition Analysis (SCA)?
a)
Code formatting
b)
Dependency vulnerability scanning
c)
Encryption
d)
Performance testing
37.
A dependency has a known CVE. Best action?
a)
Ignore
b)
Update dependency
c)
Log issue
d)
Encrypt config
38.
What is dependency drift?
a)
Network delay
b)
Uncontrolled dependency updates
c)
Data corruption
d)
Logging failure
39.
Suspicious activity is not detected. What is missing?
a)
Encryption
b)
Proper logging and monitoring
c)
Validation
d)
Caching
40.
Error messages expose stack traces to users. Risk?
a)
UX issues
b)
Information leakage
c)
Performance
d)
TLS errors
41.
Errors are handled inconsistently across services. Best improvement?
a)
Disable errors
b)
Centralized error handling
c)
Encrypt errors
d)
Add UI checks
42.
A company reviews systems for weaknesses regularly. What is this?
a)
Load testing
b)
Security auditing
c)
UI testing
d)
Monitoring
43.
A team simulates real attacks on its APIs. What is this?
a)
Unit testing
b)
Penetration testing
c)
Logging
d)
Compression
44.
What is the main goal of API rate limiting?
a)
Improve performance
b)
Prevent abuse and brute-force attacks
c)
Encrypt requests
d)
Cache responses
45.
An API receives thousands of requests per second from one client. Best protection?
a)
Logging only
b)
Rate limiting
c)
Encryption
d)
Input validation
46.
Why should APIs avoid exposing internal IDs directly?
a)
Performance issues
b)
They can be guessed or enumerated
c)
They slow databases
d)
They break caching
47.
An attacker increments numeric IDs in API requests to access other users’ data. What vulnerability is this?
a)
XSS
b)
Broken Object Level Authorization (BOLA)
c)
CSRF
d)
ReDoS
48.
What is the safest response when an API request is unauthorized?
a)
Return full error details
b)
Return a generic error message
c)
Return stack trace
d)
Return database error
49.
Why should APIs validate file uploads?
a)
To reduce storage
b)
To prevent malicious files
c)
To speed uploads
d)
To improve UI
50.
An API allows any file type to be uploaded and executed. Best mitigation?
a)
Log uploads
b)
Restrict file types and execution
c)
Encrypt files
d)
Increase timeout
Reset
