API Security: Tokens, Rate Limiting u0026 Threat Prevention Quiz Quiz

Sharpen your understanding of API security by exploring how tokens, rate limiting, and threat prevention measures defend against common vulnerabilities. This quiz covers best practices for securing APIs and mitigating unauthorized access, resource abuse, and attack vectors.

1. Authentication Tokens and Replay Attacks

   Which type of authentication token is most effective at preventing replay attacks during API communication, especially when sensitive user data is involved?

   1. Long-lived static tokens
   2. Short-lived tokens with unique identifiers
   3. Stateless bearer tokens
   4. Expired tokens

   Explanation: Short-lived tokens with unique identifiers are effective against replay attacks because they expire quickly and have unique values for each session, minimizing the attack window. Stateless bearer tokens work well for scalability but can be at risk of replay if not refreshed often enough. Long-lived static tokens are especially vulnerable to being reused in replay attacks. Expired tokens are not valid and offer no protection or functionality.

2. Rate Limiting Strategies

   When an API receives too many requests from a single client within a short time frame, which technique should be implemented to fairly control resource usage without blocking legitimate users?

   1. Constant open connections
   2. Rate limiting based on IP address
   3. Extended caching of responses
   4. Public endpoint exposure

   Explanation: Rate limiting based on IP address helps ensure that no single user can overwhelm the API, providing fairness and preventing resource exhaustion. Public endpoint exposure increases risk instead of control, as it allows unrestricted access. Constant open connections can further strain resources and is not a control strategy. Extended caching can help performance but does not prevent request floods.

3. Threat Prevention: Injection Attacks

   How can APIs best defend against injection attacks, such as SQL injection, when processing user-supplied parameters?

   1. Using only client-side filtering
   2. Input validation and parameterized queries
   3. Allowing raw user input
   4. Ignoring input formats

   Explanation: Input validation and parameterized queries ensure that user input does not alter the intended structure of backend queries, effectively blocking injection attacks. Allowing raw input increases vulnerability. Client-side filtering can be bypassed, as attackers may send requests directly to the API. Ignoring input formats provides attackers with more opportunities to exploit input fields.

4. Token Management and Scope

   In order to minimize the risk of privilege escalation, which characteristic should access tokens have when granting API permissions?

   1. Tokens without expiry
   2. Fine-grained, least-privilege scopes
   3. Global, unrestricted access
   4. Tokens hardcoded in client apps

   Explanation: Fine-grained, least-privilege scopes restrict tokens to only necessary permissions, reducing the impact if a token is compromised. Global, unrestricted access tokens increase risk significantly. Hardcoded tokens are easier to extract and misuse. Tokens without expiry compound risk by remaining valid even after exposure or abuse.

5. API Security Threat Detection

   Which practice helps an API proactively detect unusual or potentially malicious activity as part of its threat prevention strategy?

   1. Disabling error messages
   2. Continuous monitoring of access logs
   3. Storing plain-text passwords
   4. Manual endpoint testing

   Explanation: Continuous monitoring of access logs allows security teams to identify suspicious patterns and respond to threats in real time. Manual endpoint testing is important but cannot keep up with ongoing threats. Disabling error messages may obscure issues but does not detect anything. Storing plain-text passwords introduces major vulnerabilities and does not aid detection.