What is the difference between authentication and authorization?

Authentication verifies user identity; authorization manages user permissions

Authentication manages user permissions; authorization verifies user identity

Authentication secures data in transit; authorization secures data at rest

Authentication is for internal users; authorization is for external users

An authorization framework for delegating access to third-party applications

A specialized hashing algorithm for protecting passwords in a database

A transport-level encryption protocol for securing raw socket connections

A multi-factor authentication system using hardware-based security keys

What is a JWT (JSON Web Token)?

A stateless, self-contained token used to securely transmit encoded data

A stateful session identifier that requires server-side database storage

A client-side cookie specifically designed for cross-domain tracking

An encrypted XML structure used for enterprise-level single sign-on flows

What are the three parts of a JWT?

Header (algorithm), Payload (claims), and Signature (verification)

Username (identity), Password (secret), and Token (identifier)

Request (method), Response (status), and Verification (check)

Encryption (method), Compression (format), and Encoding (type)

What is an API key, and when should it be used?

A simple identifier for public access, basic usage, and rate limiting

A complex encrypted credential used primarily for administrative access

A dynamic token that replaces the need for HTTPS during data transfers

A required component for implementing OAuth2 authorization code flows

What is HTTPS, and why is it critical for APIs?

A secure transport protocol using TLS to prevent data interception

A high-speed version of HTTP that optimizes response delivery times

A token-based security standard used to manage user session states

A server-side validation technique for sanitizing incoming API requests

What is CORS (Cross-Origin Resource Sharing) in APIs?

A mechanism that uses HTTP headers to allow cross-domain resource access

A security rule that automatically blocks all incoming external requests

A caching strategy used to store API responses across different servers

An authentication protocol designed specifically for GraphQL subscriptions

What is rate limiting in API security?

Restricting the number of requests a user can make in a specific timeframe

Reducing the maximum size of data payloads returned by the API server

Enforcing specific business hours when the API is available for clients

A tiered billing model based on the total data consumed by an application

What is a brute force attack on APIs?

Attempting to guess credentials by trying many combinations in rapid succession

Injecting malicious scripts into the database to corrupt user account data

Overloading server memory by sending massive files to specific endpoints

Redirecting secure HTTPS traffic to an unencrypted and malicious server

What is injection attack vulnerability?

Inserting malicious commands through input fields to execute unauthorized code

A diagnostic tool used by developers to monitor real-time API performance

A method for securely sharing database credentials between microservices

An architectural pattern used to automatically scale server-side resources

What is XSS (Cross-Site Scripting)?

Executing malicious scripts in the browser of users viewing a web page

Intercepting unencrypted data as it travels between the client and server

Bypassing the server-side firewall to access sensitive database records

A specialized encryption method used to secure cross-origin API calls

What is CSRF (Cross-Site Request Forgery)?

Forcing an authenticated user to execute unwanted actions on a trusted site

Scanning an API for open ports and unpatched software vulnerabilities

A technique used to crack passwords by comparing hashes to a precomputed list

A performance bottleneck caused by too many simultaneous API requests

What is the principle of least privilege in API security?

Providing users only the minimum access levels required to perform their jobs

Allowing all authenticated users full access to the administrative dashboard

A method for automatically increasing user permissions during peak hours

A policy that requires users to change passwords every thirty days

What is a refresh token, and why is it used?

A long-lived token used to obtain new access tokens without re-authenticating

A temporary credential used to reset a forgotten user account password

A security mechanism that clears the browser cache after every API logout

A specialized key used to encrypt data stored within the local database

What is two-factor authentication (2FA)?

Requiring two independent forms of evidence to verify a user identity

Using two different passwords to access the same administrative account

A process where two separate APIs must approve a single user request

An encryption method that applies two layers of hashing to a password

What is token expiration, and why is it important?

Limiting the valid lifetime of a token to reduce the risk of misuse

The time it takes for a server to process and validate a security token

A technique for compressing tokens to reduce network bandwidth usage

A requirement that tokens be generated only during business hours

What is the difference between session-based and token-based authentication?

Sessions store state on the server; tokens are stateless and self-contained

Sessions are used for mobile apps; tokens are used for desktop browsers

Sessions require HTTPS; tokens can be used over unencrypted connections

Sessions use JSON objects; tokens use XML structures for data exchange

What is a salt in password hashing?

Unique random data added to a password before hashing to prevent collisions

A symmetric encryption key used to decode passwords in the database

A hardware device used to generate truly random numbers for encryption

A validation rule that requires passwords to include special characters

What is the purpose of Content Security Policy (CSP)?

An HTTP header that restricts the sources from which scripts can load

A policy that defines which users are allowed to edit API documentation

A standard for encrypting sensitive content before it is stored in a database

A system for automatically translating API content into multiple languages

What is API versioning, and how does it relate to security?

Managing API updates to fix security flaws without breaking existing clients

Assigning a unique version number to every user for tracking permissions

A method for rotating encryption keys every time a new version is released

Restricting API access based on the version of the user’s operating system

What is API authentication vs. authorization in microservices?

Services verify each other identities and then check specific access rights

Authentication is for external traffic; authorization is for internal traffic

Authorization verifies the service; authentication defines the data format

They are combined into a single step to optimize network performance

What is the responsibility of the API provider vs. client in security?

Providers secure the infrastructure; clients secure their tokens and requests

The provider is solely responsible for all aspects of the security lifecycle

The client is responsible for encryption; the provider handles user login

Security responsibilities are handled automatically by the cloud host

What is API key rotation, and why is it important?

Periodically replacing API keys to minimize damage if a key is leaked

Switching between different keys to bypass secondary rate limiting rules

A process for updating the encryption algorithm used by the API

The practice of sharing a single API key among multiple developer teams

What is secrets management in API authentication?

Using specialized tools to securely store and inject API credentials

The process of obfuscating code to make it difficult for hackers to read

Restricting the visibility of API documentation to authorized users only

A policy that forbids developers from discussing API security protocols

What is mutual TLS (mTLS) authentication?

A process where both the client and server verify each other certificates

Using two different encryption layers to protect a single API connection

A method for synchronizing time between a client and a security server

An authentication flow that requires a user to enter two different passwords

What is the difference between public and private APIs?

Public APIs are open to external users; private APIs are internal only

Public APIs use JSON; private APIs use binary formats for data transfer

Public APIs require no security; private APIs require full encryption

Public APIs are free to use; private APIs always require a paid license

What is webhook security?

Verifying the authenticity of incoming callbacks using signatures

A method for preventing webhooks from timing out during execution

The practice of encrypting the URL of the webhook receiver endpoint

A rule that limits the number of webhooks a single server can receive

What are GraphQL-specific security concerns?

Risks involving recursive queries, introspection, and field permissions

Issues related to buffer overflows and hardware-level memory leaks

Vulnerabilities in the underlying TCP/IP stack used for data transfer

A lack of support for modern encryption standards like TLS 1.3

What is the importance of logging and monitoring API security?

Detecting patterns of abuse, failed logins, and unauthorized access

Storing user passwords in a plain text file for easy administrative recovery

Recording every successful user request to improve the API search rankings

Automatically blocking any user who accesses the API from a new location

What is API documentation and security?

Clearly explaining security requirements without leaking internal details

A public list of all user passwords and their corresponding account IDs

Strictly forbidding the use of any external tools to test API endpoints

The practice of hiding the API documentation to prevent hackers from finding it

Quizzes

API Security Security Quizzes

API Security & Authentication: Protecting Your APIs

Mohammad Abu Mattar20 QuestionsIntermediatePublished: 01 Mar, 2026

Markdown for AI

API Security & Authentication: Protecting Your APIs

Up to 20 questions, shuffled on every run

Quiz Configuration

Enterto start

Welcome to the API Security & Authentication Quiz! This quiz will test your knowledge of key concepts and best practices for securing APIs. Each question is designed to challenge your understanding of authentication, authorization, OAuth2, JWT, API keys, HTTPS, CORS, rate limiting, and common vulnerabilities. Good luck!

Answer key and explanations20 questions

The quiz above draws 20 questions at random from these 30, so a second attempt will not be the same run. Everything in the pool is listed here.

What is the difference between authentication and authorization?
AnswerAuthentication verifies user identity; authorization manages user permissions
What is OAuth2?
AnswerAn authorization framework for delegating access to third-party applications
What is a JWT (JSON Web Token)?
AnswerA stateless, self-contained token used to securely transmit encoded data
What are the three parts of a JWT?
AnswerHeader (algorithm), Payload (claims), and Signature (verification)
What is an API key, and when should it be used?
AnswerA simple identifier for public access, basic usage, and rate limiting
What is HTTPS, and why is it critical for APIs?
AnswerA secure transport protocol using TLS to prevent data interception
What is CORS (Cross-Origin Resource Sharing) in APIs?
AnswerA mechanism that uses HTTP headers to allow cross-domain resource access
What is rate limiting in API security?
AnswerRestricting the number of requests a user can make in a specific timeframe
What is a brute force attack on APIs?
AnswerAttempting to guess credentials by trying many combinations in rapid succession
What is injection attack vulnerability?
AnswerInserting malicious commands through input fields to execute unauthorized code
What is XSS (Cross-Site Scripting)?
AnswerExecuting malicious scripts in the browser of users viewing a web page
What is CSRF (Cross-Site Request Forgery)?
AnswerForcing an authenticated user to execute unwanted actions on a trusted site
What is the principle of least privilege in API security?
AnswerProviding users only the minimum access levels required to perform their jobs
What is a refresh token, and why is it used?
AnswerA long-lived token used to obtain new access tokens without re-authenticating
What is two-factor authentication (2FA)?
AnswerRequiring two independent forms of evidence to verify a user identity
What is token expiration, and why is it important?
AnswerLimiting the valid lifetime of a token to reduce the risk of misuse
What is the difference between session-based and token-based authentication?
AnswerSessions store state on the server; tokens are stateless and self-contained
What is a salt in password hashing?
AnswerUnique random data added to a password before hashing to prevent collisions
What is the purpose of Content Security Policy (CSP)?
AnswerAn HTTP header that restricts the sources from which scripts can load
What is API versioning, and how does it relate to security?
AnswerManaging API updates to fix security flaws without breaking existing clients
What is API authentication vs. authorization in microservices?
AnswerServices verify each other identities and then check specific access rights
What is the responsibility of the API provider vs. client in security?
AnswerProviders secure the infrastructure; clients secure their tokens and requests
What is API key rotation, and why is it important?
AnswerPeriodically replacing API keys to minimize damage if a key is leaked
What is secrets management in API authentication?
AnswerUsing specialized tools to securely store and inject API credentials
What is mutual TLS (mTLS) authentication?
AnswerA process where both the client and server verify each other certificates
What is the difference between public and private APIs?
AnswerPublic APIs are open to external users; private APIs are internal only
What is webhook security?
AnswerVerifying the authenticity of incoming callbacks using signatures
What are GraphQL-specific security concerns?
AnswerRisks involving recursive queries, introspection, and field permissions
What is the importance of logging and monitoring API security?
AnswerDetecting patterns of abuse, failed logins, and unauthorized access
What is API documentation and security?
AnswerClearly explaining security requirements without leaking internal details