---
title: "API Security & Authentication: Protecting Your APIs"
description: "Master API security fundamentals: authentication, authorization, OAuth2, JWT, API keys, HTTPS, rate limiting, CORS, and common vulnerabilities. Secure your APIs against attacks."
author: "Mohammad Abu Mattar"
canonical: https://mkabumattar.com/quizzes/post/api-security-authentication-quiz
---

# API Security & Authentication: Protecting Your APIs

Welcome to the API Security & Authentication Quiz! This quiz will test your knowledge of key concepts and best practices for securing APIs. Each question is designed to challenge your understanding of authentication, authorization, OAuth2, JWT, API keys, HTTPS, CORS, rate limiting, and common vulnerabilities. Good luck!

## Questions

### 1. What is the difference between authentication and authorization?

- **Authentication verifies user identity; authorization manages user permissions** ✅
  - Authentication: login validates credentials. Authorization: checking if user can access /admin. Both needed for security.
- Authentication manages user permissions; authorization verifies user identity
  - These roles are swapped; identity must be confirmed before permissions are checked.
- Authentication secures data in transit; authorization secures data at rest
  - Encryption handles data security; auth handles identity and access control.
- Authentication is for internal users; authorization is for external users
  - Both concepts apply to all users regardless of their internal or external status.

**Hint:** Think about identity verification vs. permission checks.

### 2. What is OAuth2?

- **An authorization framework for delegating access to third-party applications** ✅
  - OAuth2 enables: "Login with Google/GitHub". User grants permission without sharing passwords.
- A specialized hashing algorithm for protecting passwords in a database
  - That is bcrypt or Argon2; OAuth2 is a framework for delegated access.
- A transport-level encryption protocol for securing raw socket connections
  - That is TLS; OAuth2 operates at the application layer for authorization.
- A multi-factor authentication system using hardware-based security keys
  - That is FIDO/WebAuthn; OAuth2 focuses on token-based delegation.

**Hint:** Think about delegated authorization without sharing passwords.

### 3. What is a JWT (JSON Web Token)?

- **A stateless, self-contained token used to securely transmit encoded data** ✅
  - JWT: header.payload.signature. Stateless, verifiable, and common for API auth.
- A stateful session identifier that requires server-side database storage
  - JWTs are stateless; session IDs require server-side state to be useful.
- A client-side cookie specifically designed for cross-domain tracking
  - JWTs are for authentication, not specifically for marketing or tracking purposes.
- An encrypted XML structure used for enterprise-level single sign-on flows
  - That is SAML; JWT uses JSON objects and is typically used in modern web APIs.

**Hint:** Think about a token containing encoded information.

### 4. What are the three parts of a JWT?

- **Header (algorithm), Payload (claims), and Signature (verification)** ✅
  - JWT = base64(header).base64(payload).signature.
- Username (identity), Password (secret), and Token (identifier)
  - These are login credentials, not the structural components of the token itself.
- Request (method), Response (status), and Verification (check)
  - These are parts of an HTTP lifecycle, not the internal structure of a JWT.
- Encryption (method), Compression (format), and Encoding (type)
  - While JWTs are encoded, these terms do not represent its three core segments.

**Hint:** Think about header, payload, and security.

### 5. What is an API key, and when should it be used?

- **A simple identifier for public access, basic usage, and rate limiting** ✅
  - API keys: easy, but stateless. Use for public data, not for sensitive financial data.
- A complex encrypted credential used primarily for administrative access
  - API keys are usually simple strings and should not be used for high-privilege access.
- A dynamic token that replaces the need for HTTPS during data transfers
  - API keys do not provide encryption; HTTPS is still required for security.
- A required component for implementing OAuth2 authorization code flows
  - OAuth2 uses Client IDs and Secrets, which differ from standard static API keys.

**Hint:** Think about simple authentication for API access.

### 6. What is HTTPS, and why is it critical for APIs?

- **A secure transport protocol using TLS to prevent data interception** ✅
  - HTTPS encrypts data in transit, protecting credentials and tokens from exposure.
- A high-speed version of HTTP that optimizes response delivery times
  - HTTPS adds a small overhead for encryption; it is not inherently faster than HTTP.
- A token-based security standard used to manage user session states
  - That refers to JWT or sessions; HTTPS is for secure transport encryption.
- A server-side validation technique for sanitizing incoming API requests
  - HTTPS secures the connection; validation occurs inside the application logic.

**Hint:** Think about encrypted communication over the network.

### 7. What is CORS (Cross-Origin Resource Sharing) in APIs?

- **A mechanism that uses HTTP headers to allow cross-domain resource access** ✅
  - CORS headers allow Domain A to call Domain B's API via browser-enforced policies.
- A security rule that automatically blocks all incoming external requests
  - CORS facilitates controlled access rather than acting as a simple firewall.
- A caching strategy used to store API responses across different servers
  - That is content delivery or HTTP caching; CORS handles origin-based access.
- An authentication protocol designed specifically for GraphQL subscriptions
  - CORS applies to all HTTP-based APIs, including REST, SOAP, and GraphQL.

**Hint:** Think about requests from different domains/origins.

### 8. What is rate limiting in API security?

- **Restricting the number of requests a user can make in a specific timeframe** ✅
  - Prevents DDoS and brute force by limiting frequency (e.g., 100 requests per hour).
- Reducing the maximum size of data payloads returned by the API server
  - That is payload size limiting; rate limiting focus on request frequency.
- Enforcing specific business hours when the API is available for clients
  - Rate limiting is based on request volume, not specific times of the day.
- A tiered billing model based on the total data consumed by an application
  - While related to usage, rate limiting is a technical defense, not a billing system.

**Hint:** Think about preventing abuse from excessive requests.

### 9. What is a brute force attack on APIs?

- **Attempting to guess credentials by trying many combinations in rapid succession** ✅
  - Brute force attempts all combinations. Prevent with rate limiting and 2FA.
- Injecting malicious scripts into the database to corrupt user account data
  - That is an injection attack; brute force is specific to credential guessing.
- Overloading server memory by sending massive files to specific endpoints
  - That is a Denial of Service (DoS) attack; brute force targets authentication.
- Redirecting secure HTTPS traffic to an unencrypted and malicious server
  - That is a Man-in-the-Middle (MitM) attack, not a brute force attempt.

**Hint:** Think about trying many passwords/credentials rapidly.

### 10. What is injection attack vulnerability?

- **Inserting malicious commands through input fields to execute unauthorized code** ✅
  - Examples include SQL and Command Injection. Prevent with parameterized queries.
- A diagnostic tool used by developers to monitor real-time API performance
  - Injection is a security flaw, not a development or monitoring tool.
- A method for securely sharing database credentials between microservices
  - That is secrets management; injection is an exploit of untrusted input.
- An architectural pattern used to automatically scale server-side resources
  - That is auto-scaling; injection involves malicious code execution.

**Hint:** Think about inserting malicious code via input.

### 11. What is XSS (Cross-Site Scripting)?

- **Executing malicious scripts in the browser of users viewing a web page** ✅
  - XSS affects users by running scripts in their browser. Prevent via output escaping.
- Intercepting unencrypted data as it travels between the client and server
  - That is sniffing or MitM; XSS focuses on client-side script execution.
- Bypassing the server-side firewall to access sensitive database records
  - XSS targets the client/browser, while firewalls target the network/server.
- A specialized encryption method used to secure cross-origin API calls
  - XSS is a vulnerability, not a security or encryption standard.

**Hint:** Think about injecting JavaScript into web pages.

### 12. What is CSRF (Cross-Site Request Forgery)?

- **Forcing an authenticated user to execute unwanted actions on a trusted site** ✅
  - Exploits the trust a site has in a browser. Prevent with CSRF tokens.
- Scanning an API for open ports and unpatched software vulnerabilities
  - That is reconnaissance or port scanning, not a request forgery attack.
- A technique used to crack passwords by comparing hashes to a precomputed list
  - That is a rainbow table attack; CSRF is about unauthorized actions.
- A performance bottleneck caused by too many simultaneous API requests
  - CSRF is a security flaw, not a performance or scalability issue.

**Hint:** Think about tricking users into performing unwanted actions.

### 13. What is the principle of least privilege in API security?

- **Providing users only the minimum access levels required to perform their jobs** ✅
  - Reduces risk by ensuring a compromised account has limited permissions.
- Allowing all authenticated users full access to the administrative dashboard
  - This is the opposite of least privilege and creates a high security risk.
- A method for automatically increasing user permissions during peak hours
  - Privilege escalation is usually a security risk, not a defensive principle.
- A policy that requires users to change passwords every thirty days
  - This is a password rotation policy, not a privilege management principle.

**Hint:** Think about giving minimal necessary permissions.

### 14. What is a refresh token, and why is it used?

- **A long-lived token used to obtain new access tokens without re-authenticating** ✅
  - Access tokens are short-lived; refresh tokens allow seamless renewal.
- A temporary credential used to reset a forgotten user account password
  - That is a password reset token; refresh tokens manage session continuity.
- A security mechanism that clears the browser cache after every API logout
  - Refresh tokens manage authentication state, not browser storage or cache.
- A specialized key used to encrypt data stored within the local database
  - Refresh tokens are for identity/session management, not data encryption.

**Hint:** Think about extending sessions without re-authenticating.

### 15. What is two-factor authentication (2FA)?

- **Requiring two independent forms of evidence to verify a user identity** ✅
  - Usually something you know (password) and something you have (phone code).
- Using two different passwords to access the same administrative account
  - 2FA requires different categories of verification, not just two passwords.
- A process where two separate APIs must approve a single user request
  - That is a multi-party authorization flow, not standard 2FA.
- An encryption method that applies two layers of hashing to a password
  - Double hashing is a cryptographic technique, not a factor of authentication.

**Hint:** Think about requiring two forms of verification.

### 16. What is token expiration, and why is it important?

- **Limiting the valid lifetime of a token to reduce the risk of misuse** ✅
  - Reduces the window of opportunity for an attacker if a token is stolen.
- The time it takes for a server to process and validate a security token
  - That is processing latency; expiration is about the token's validity window.
- A technique for compressing tokens to reduce network bandwidth usage
  - Expiration is a security measure, not a performance or compression method.
- A requirement that tokens be generated only during business hours
  - Token validity is based on a duration, not the time of day they were created.

**Hint:** Think about limiting token lifetime.

### 17. What is the difference between session-based and token-based authentication?

- **Sessions store state on the server; tokens are stateless and self-contained** ✅
  - Tokens (like JWT) scale better because the server doesn’t need to store session data.
- Sessions are used for mobile apps; tokens are used for desktop browsers
  - Both methods can be used on any platform, though tokens are preferred for APIs.
- Sessions require HTTPS; tokens can be used over unencrypted connections
  - Both methods strictly require HTTPS to protect credentials from interception.
- Sessions use JSON objects; tokens use XML structures for data exchange
  - Data format (JSON/XML) is independent of the authentication strategy used.

**Hint:** Think about server storage and statelessness.

### 18. What is a salt in password hashing?

- **Unique random data added to a password before hashing to prevent collisions** ✅
  - Salt ensures identical passwords have different hashes, blocking rainbow table attacks.
- A symmetric encryption key used to decode passwords in the database
  - Hashing is one-way and cannot be decoded; salt is for unique hash generation.
- A hardware device used to generate truly random numbers for encryption
  - That is an HSM or TRNG; salt is a digital data string used in software.
- A validation rule that requires passwords to include special characters
  - That is a password complexity policy, not a cryptographic salt.

**Hint:** Think about preventing rainbow table attacks.

### 19. What is the purpose of Content Security Policy (CSP)?

- **An HTTP header that restricts the sources from which scripts can load** ✅
  - CSP helps prevent XSS by telling the browser which domains are trusted.
- A policy that defines which users are allowed to edit API documentation
  - CSP is a browser security header, not a documentation access control list.
- A standard for encrypting sensitive content before it is stored in a database
  - CSP manages resource loading in the browser, not data encryption at rest.
- A system for automatically translating API content into multiple languages
  - That is localization (i18n); CSP is strictly a security mechanism.

**Hint:** Think about restricting where scripts can be loaded.

### 20. What is API versioning, and how does it relate to security?

- **Managing API updates to fix security flaws without breaking existing clients** ✅
  - Allows developers to roll out secure v2 endpoints while deprecating insecure v1 versions.
- Assigning a unique version number to every user for tracking permissions
  - Versioning applies to the API interface, not to individual user accounts.
- A method for rotating encryption keys every time a new version is released
  - Key rotation is a separate process from API interface versioning.
- Restricting API access based on the version of the user’s operating system
  - API versioning refers to the service itself, not the client’s software version.

**Hint:** Think about maintaining backward compatibility while fixing issues.

### 21. What is API authentication vs. authorization in microservices?

- **Services verify each other identities and then check specific access rights** ✅
  - In microservices, mTLS often handles identity, while scopes handle permissions.
- Authentication is for external traffic; authorization is for internal traffic
  - Both are required for all traffic to ensure a "Zero Trust" architecture.
- Authorization verifies the service; authentication defines the data format
  - Authentication verifies identity; data format is handled by content negotiation.
- They are combined into a single step to optimize network performance
  - They remain distinct steps to ensure granular and manageable security.

**Hint:** Think about service-to-service authentication.

### 22. What is the responsibility of the API provider vs. client in security?

- **Providers secure the infrastructure; clients secure their tokens and requests** ✅
  - Security is a shared responsibility; both parties must implement defenses.
- The provider is solely responsible for all aspects of the security lifecycle
  - Clients must also act securely, such as by not hardcoding API keys.
- The client is responsible for encryption; the provider handles user login
  - Both must support encryption (HTTPS) and participate in secure authentication.
- Security responsibilities are handled automatically by the cloud host
  - Cloud hosts provide tools, but developers must configure them correctly.

**Hint:** Think about shared security concerns.

### 23. What is API key rotation, and why is it important?

- **Periodically replacing API keys to minimize damage if a key is leaked** ✅
  - Regular rotation limits how long a stolen key remains useful to an attacker.
- Switching between different keys to bypass secondary rate limiting rules
  - This is usually a violation of terms and not a security best practice.
- A process for updating the encryption algorithm used by the API
  - Key rotation replaces credentials, not the underlying cryptographic math.
- The practice of sharing a single API key among multiple developer teams
  - Sharing keys is insecure; rotation is about replacing keys for safety.

**Hint:** Think about periodically changing credentials.

### 24. What is secrets management in API authentication?

- **Using specialized tools to securely store and inject API credentials** ✅
  - Tools like Vault or AWS Secrets Manager keep keys out of source code.
- The process of obfuscating code to make it difficult for hackers to read
  - That is code obfuscation; secrets management focuses on credential storage.
- Restricting the visibility of API documentation to authorized users only
  - This is documentation access control, not secrets management.
- A policy that forbids developers from discussing API security protocols
  - Secrets management is a technical infrastructure, not a social policy.

**Hint:** Think about storing credentials securely outside code.

### 25. What is mutual TLS (mTLS) authentication?

- **A process where both the client and server verify each other certificates** ✅
  - Standard TLS verifies the server; mTLS ensures the client is also trusted.
- Using two different encryption layers to protect a single API connection
  - mTLS is a mutual handshake process, not a double-encryption method.
- A method for synchronizing time between a client and a security server
  - That is NTP; mTLS is specifically for identity verification via certificates.
- An authentication flow that requires a user to enter two different passwords
  - That is two-factor authentication; mTLS uses certificates for services.

**Hint:** Think about both client and server verifying each other.

### 26. What is the difference between public and private APIs?

- **Public APIs are open to external users; private APIs are internal only** ✅
  - Public APIs face the internet; private APIs are restricted to internal networks.
- Public APIs use JSON; private APIs use binary formats for data transfer
  - The data format is an architectural choice, not defined by the API audience.
- Public APIs require no security; private APIs require full encryption
  - Both require strong security; public APIs often require even stricter defenses.
- Public APIs are free to use; private APIs always require a paid license
  - Pricing models are independent of whether an API is public or private.

**Hint:** Think about who can access the API.

### 27. What is webhook security?

- **Verifying the authenticity of incoming callbacks using signatures** ✅
  - Ensures the webhook you received actually came from the expected provider.
- A method for preventing webhooks from timing out during execution
  - This is a timeout or performance issue, not a security verification step.
- The practice of encrypting the URL of the webhook receiver endpoint
  - URLs should be over HTTPS, but "encrypting the URL" is not a standard practice.
- A rule that limits the number of webhooks a single server can receive
  - This is a form of rate limiting, not a specific webhook authenticity check.

**Hint:** Think about server callbacks to external systems.

### 28. What are GraphQL-specific security concerns?

- **Risks involving recursive queries, introspection, and field permissions** ✅
  - Attackers can use deep nesting to crash servers or introspection to leak schemas.
- Issues related to buffer overflows and hardware-level memory leaks
  - These are low-level system flaws, not specific to GraphQL query logic.
- Vulnerabilities in the underlying TCP/IP stack used for data transfer
  - These affect all network communication and are not specific to GraphQL.
- A lack of support for modern encryption standards like TLS 1.3
  - GraphQL runs over HTTP, so it fully supports modern encryption standards.

**Hint:** Think about query complexity and introspection.

### 29. What is the importance of logging and monitoring API security?

- **Detecting patterns of abuse, failed logins, and unauthorized access** ✅
  - Monitoring helps you respond to attacks in real-time before they succeed.
- Storing user passwords in a plain text file for easy administrative recovery
  - This is a massive security violation; passwords should never be logged.
- Recording every successful user request to improve the API search rankings
  - Logging for security is about threat detection, not SEO or marketing.
- Automatically blocking any user who accesses the API from a new location
  - This is a strict security policy, but it is not the definition of logging.

**Hint:** Think about detecting attacks and anomalies.

### 30. What is API documentation and security?

- **Clearly explaining security requirements without leaking internal details** ✅
  - Good docs show how to authenticate but don’t reveal server paths or secrets.
- A public list of all user passwords and their corresponding account IDs
  - Exposing credentials in documentation would be a catastrophic security breach.
- Strictly forbidding the use of any external tools to test API endpoints
  - Documentation should encourage proper testing using authorized tools.
- The practice of hiding the API documentation to prevent hackers from finding it
  - Security through obscurity is ineffective; clear documentation is safer.

**Hint:** Think about balancing usability with security.