APi Security webinar

Which OAuth 2.0 grant type is generally considered most secure for web and mobile applications,involving an intermediary step where an authorization code is exchanged for an access token?

• Client Credentials Grant

• Resource Owner Password Credentials Grant

• Authorization Code Grant

• Refresh Token Grant

What core functionality does OpenID Connect (OIDC) add when layered on top of the OAuth 2.0protocol?

• Enhanced token encryption standards

• An identity layer for verifying end-user identity and obtaining prole data

• A simplied mechanism for API key management

• More granular rate-limiting policies

A common best practice in API security architecture is to offload security responsibilities to a central component that sits between API backends and consumers. What is this component typically called?

• Identity Provider (IDP)

• API Gateway

• Web Application Firewall (WAF)

• Backend Service Broker

What are some key advantages of implementing effective rate limiting for APIs?

• Prevention of DDoS attacks

• Enabling API usage plans for monetization

• Enforcement of fair usage policies among consumers

• Automatic encryption of API payload data

• Protection of backend systems from sudden overuse and request spikes

When a web browser invokes an API from a different origin, the Cross-Origin Resource Sharing(CORS) mechanism is often employed. What type of initial request is typically sent by the client application before the main API call?

• Discovery request

• Pre-flight request

• Handshake request

• Finalization request

Within the OpenAPI specification, which element is primarily used to define how API clients must authenticate to consume API operations?

• paths

• components

• securityDefinitions (or securitySchemes)

• info

In the XACML (eXtensible Access Control Markup Language) architecture, which component is responsible for evaluating access requests against defined policies and ultimately making the Permit or Deny decision?

• Policy Enforcement Point (PEP)

• Policy Administration Point (PAP)

• Policy Information Point (PIP)

• Policy Decision Point (PDP)

Protecting APIs against malicious payloads involves defending against which of the following types of threats?

• Threats related to JSON and XML message structures

• SQL Injection attempts

• Issues arising from insufficient logging and monitoring

• Attacks leveraging regular expression vulnerabilities

• Exploits targeting Broken Object Level Authorization

What is a standard and secure method for propagating end-user attributes or claims from an API gateway to backend services, often used for further authorization or to provide context for business logic?

• SAML Assertion

• X.509 Certificate

• JSON Web Token (JWT)

• Basic Authentication Header

AI-based API security systems offer an advantage over static controls by being particularly effective at detecting what kind of security concerns?

• Incorrectly configured SSL/TLS certificates on a server

• The absence of basic authentication on a rarely used internal API

• Complex attack patterns and subtle deviations from normal, legitimate user behavior

• Missing or incomplete API documentation for developers