API Authentication u0026 Authorization Quiz Quiz

1. Authentication vs. Authorization

   What is the primary difference between authentication and authorization in the context of API security?

   1. Authentication verifies *what* a user can access, while authorization verifies *who* the user is.
   2. Authentication verifies *who* a user is, while authorization verifies *what* a user can access.
   3. Authentication encrypts data, while authorization decrypts it.
   4. Authentication is for front-end, authorization is for back-end.
   5. Authentication and authorization are the same thing.

2. JWT Structure

   Which of the following correctly describes the typical structure of a JSON Web Token (JWT)?

   1. Header.Payload.Signature
   2. Signature.Payload.Header
   3. Payload.Header.Signature
   4. Header-Payload-Signature
   5. Header:Payload:Signature

3. OAuth 2.0 Grant Types

   Which OAuth 2.0 grant type is best suited for native mobile applications where the client cannot securely store client secrets?

   1. Authorization Code Grant
   2. Implicit Grant
   3. Resource Owner Password Credentials Grant
   4. Client Credentials Grant
   5. Grant Type Extension

4. API Key Security

   What is the most important security practice to follow when using API keys for authentication?

   1. Storing API keys in the client-side code.
   2. Using a very short API key to improve performance.
   3. Treating API keys as secrets and storing them securely on the server-side.
   4. Making API keys publicly available for easy integration.
   5. Rotating API keys annually.

5. Role-Based Access Control (RBAC)

   In Role-Based Access Control (RBAC), what is the primary advantage of assigning permissions to roles instead of directly to users?

   1. It simplifies user management and reduces redundancy.
   2. It improves API performance.
   3. It increases the complexity of the system.
   4. It eliminates the need for authentication.
   5. It makes the system less secure.

6. Middleware for Authentication

   What is the typical role of middleware in implementing authentication and authorization checks in an API endpoint?

   1. To handle database queries.
   2. To validate user input.
   3. To intercept incoming requests and verify user identity and permissions before routing to the API endpoint.
   4. To format API responses.
   5. To cache API responses.

7. Rate Limiting

   Why is rate limiting an important aspect of API security, even if authentication and authorization are properly implemented?

   1. To improve API response times.
   2. To prevent brute-force attacks and resource exhaustion.
   3. To simplify API documentation.
   4. To make the API easier to use.
   5. To enforce user agreements.

8. CORS and API Security

   How does Cross-Origin Resource Sharing (CORS) relate to API security?

   1. CORS is only relevant for front-end development.
   2. CORS helps prevent malicious websites from making unauthorized requests to your API from different origins.
   3. CORS encrypts data transmitted between the client and server.
   4. CORS handles user authentication.
   5. CORS is not related to API security.

9. Best Practice for Storing Passwords

   Which of the following is the most secure method for storing user passwords in a database?

   1. Storing passwords in plain text.
   2. Hashing passwords with a weak hashing algorithm like MD5.
   3. Hashing passwords with a strong, salted hashing algorithm like bcrypt or Argon2.
   4. Encrypting passwords using a symmetric encryption key.
   5. Not storing passwords at all.

10. OWASP Top Ten API Security Risks

    Which of the following is a common API security risk identified in the OWASP Top Ten?

    1. Excessive data validation
    2. Lack of resources and rate limiting
    3. Verbose error messaging
    4. Perfect Forward Secrecy
    5. Consistent use of HTTP headers