API Security Standards and OAuth 2.0 Quiz Answers 1. What is the primary benefit of using OAuth 2.0 in API security? A. It provides automatic encryption of all data. B. It prevents all unauthorized access completely. C. It eliminates the need for password storage. D. It allows third-party applications to access user data without sharing credentials. Answer: It allows third-party applications to access user data without sharing credentials. (D) OAuth 2.0 allows secure access to resources while keeping user credentials private. 2. Which method is NOT a key feature of OAuth 2.0? A. Access tokens B. Refresh tokens C. Authorization grants D. Public key encryption Answer: Public key encryption (D) Public key encryption is not part of the OAuth 2.0 framework. 3. What is the main purpose of rate limiting in API security? A. To allow unlimited access to trusted applications. B. To enhance user experience by speeding up response times. C. To eliminate the need for user authentication. D. To prevent excessive consumption of resources by clients. Answer: To prevent excessive consumption of resources by clients. (D) Rate limiting helps protect APIs from overload and abuse. 4. Which of the following is TRUE regarding JWT authentication? A. JWTs require a central server for ongoing verification. B. JWTs cannot be used for authorization purposes. C. JWTs can contain claims about a user's privileges. D. JWTs are primarily used for data encryption. Answer: JWTs can contain claims about a user's privileges. (C) JWTs can securely convey user-related claims such as roles and privileges. 5. Which security practice is essential for protecting data both at rest and in transit? A. Limiting access to external networks. B. Employing secure encryption methods. C. Implementing user-friendly design standards. D. Regularly updating user passwords. Answer: Employing secure encryption methods. (B) Using secure encryption methods is crucial to safeguard sensitive data. 6. What is a common strategy to prevent malicious code injection in APIs? A. Enforcing strict password requirements. B. Regularly changing API endpoints. C. Using proper input validation. D. Monitoring network traffic continuously. Answer: Using proper input validation. (C) Proper input validation helps ensure that malicious inputs are rejected. 7. Which of the following is NOT a feature of JWTs? A. Complex format requiring heavy processing B. Self-contained information packets C. Compact size for transmission D. Support for claims regarding user information Answer: Complex format requiring heavy processing (A) JWTs are lightweight and designed for efficient transmission, not complex processing. 8. What role do refresh tokens play in OAuth 2.0? A. They allow the client to obtain new access tokens. B. They are used to replace access tokens entirely. C. They prevent data from being shared with third parties. D. They increase the authorization code's validity time. Answer: They allow the client to obtain new access tokens. (A) Refresh tokens provide a means for clients to request new access tokens without re-authenticating the user.