UNIT III SECURE API DEVELOPMENT
Two Mark Questions with Answers:
1. What is the purpose of session cookies in API security? Session cookies are used to maintain user
sessions and authenticate requests to API endpoints.
2. What authentication method relies on the exchange of tokens for access to APIs? Token-based
authentication relies on the exchange of tokens for access to APIs.
3. How does rate limiting contribute to the availability of APIs? Rate limiting helps prevent abuse or
overload of APIs by limiting the number of requests a client can make within a specific time frame,
thus ensuring availability.
4. What is the role of encryption in API security? Encryption is used to protect data transmitted
between clients and APIs from unauthorized access or interception.
5. Why is audit logging important in API security? Audit logging helps track and monitor API activity,
providing visibility into who accessed the API, when, and what actions were performed, aiding in
security analysis and compliance.
6. What is the purpose of API keys in securing service-to-service APIs? API keys are used to
authenticate service-to-service API requests, ensuring that only authorized services can access the
API.
7. Which authorization framework is commonly used for securing APIs and granting access to
resources? OAuth2 is commonly used for securing APIs and granting access to resources through
authorization mechanisms like access tokens.
8. How does a service mesh contribute to securing microservice APIs? A service mesh provides a
dedicated infrastructure layer for handling communication between microservices, enabling features
like encryption, authentication, and traffic control to enhance security.
9. What measure is used for locking down network connections in API security? Firewalls and
network policies are used for locking down network connections to control traffic flow and restrict
access to API endpoints.
10. How are incoming requests secured in API development? Incoming requests are secured through
mechanisms like authentication, authorization, encryption, and validation to ensure that only
authorized and valid requests are processed by the API.
11. What security mechanism is commonly used to maintain user sessions in API interactions?
Session cookies are commonly used to maintain user sessions in API interactions, ensuring stateful
communication between clients and servers.
12. Explain the concept of token-based authentication in API security. Token-based authentication
involves the exchange of tokens (e.g., JSON Web Tokens) between clients and servers to
authenticate and authorize API requests, eliminating the need for server-side sessions.
13. How does rate limiting contribute to the protection of APIs from abuse? Rate limiting restricts
the number of requests that can be made to an API within a specified time frame, preventing abuse
or overload of the API infrastructure by limiting the rate at which requests can be processed.
14. What role does encryption play in securing data transmitted between clients and APIs?
Encryption ensures that data transmitted between clients and APIs is encrypted, preventing
unauthorized access or interception of sensitive information during transmission.
15. Why is audit logging considered essential in API security? Audit logging provides a record of API
activity, including details such as who accessed the API, when, and what actions were performed,
enabling security monitoring, analysis, and compliance enforcement.
16. How are API keys used to authenticate service-to-service API requests? API keys are used as
credentials to authenticate service-to-service API requests, allowing only authorized services with
valid API keys to access the API endpoints.
17. What is OAuth2, and how does it contribute to securing APIs? OAuth2 is an authorization
framework that allows third-party applications to obtain limited access to a user's resources without
exposing their credentials. It enhances API security by providing mechanisms for secure access
delegation and resource authorization.
18. What are the primary security benefits of using a service mesh in microservice architectures? The
primary security benefits of using a service mesh in microservice architectures include centralized
management of security policies, encryption of communication between services, authentication,
and authorization mechanisms, and fine-grained traffic control.
19. How can network connections be locked down to enhance API security? Network connections
can be locked down by implementing firewall rules, network segmentation, and access control
policies to restrict unauthorized access to API endpoints and resources.
20. What measures can be implemented to secure incoming requests in API development? Incoming
requests can be secured by implementing authentication mechanisms, authorization checks, input
validation, encryption of sensitive data, and rate limiting to mitigate potential security
PART-B
[Link] based authentication, session cookies
2. Discuss the role of session cookies and token-based authentication in securing API.
3. Explain the concept of API security controls and their importance in addressing threats to API
endpoints.
4. Looking down network connection
5. Securing incoming request