All quizzesMedium
API Security Patterns
Preview — 3 of 10 questions
Database disks are encrypted, but the app-to-database network connection is plaintext. Which threat remains directly exposed?
ADisk encryption automatically authenticates every network client.
BAn observer on that network path can read database traffic.
CA stolen powered-off disk can necessarily be read without a key.
DSQL queries become immune to injection because storage is encrypted.
A browser-based app needs a user's delegated calendar access without holding a client secret. Which OAuth approach fits?
AUse an app-only service token to represent every user's calendar consent.
BAuthorization code flow with PKCE and appropriate redirect validation.
CClient credentials flow using a secret embedded in browser JavaScript.
DUse the implicit flow and depend on a URL fragment as the sole protection.
An API expects tokens from one issuer using an approved algorithm. Which validation policy is appropriate?
AVerify the allowed algorithm, signature, issuer, audience and time claims.
BAccept any validly signed token regardless of issuer or intended audience.
CCheck only expiry because an unexpired token proves authenticity.
DTrust the token's declared algorithm and decode its payload without verification.
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.