1. What is Rate limiting ? Junior A. Broken Object Level Authorization, the top API risk where an API fails to check object ownership B. an API returning more fields than the client needs, leaking sensitive data C. capping nested query depth to prevent resource-exhaustion denial of service D. capping how many requests a client may make in a window to curb abuse and brute force
2. Which term means: "capping how many requests a client may make in a window to curb abuse and brute force"? Junior A. BFLA B. Rate limiting C. GraphQL introspection abuse D. API gateway
3. Which statement is correct? Junior A. Rate limiting — binding client JSON to internal fields the caller should not be able to set B. Rate limiting — capping how many requests a client may make in a window to curb abuse and brute force C. Rate limiting — entry point that centralizes auth, rate limiting, and routing for backend APIs D. Rate limiting — validating an HMAC signature on inbound webhooks to confirm they came from the real sender
4. What is API key ? Junior A. querying the GraphQL schema to map and probe an API's full attack surface B. binding client JSON to internal fields the caller should not be able to set C. static token identifying and authenticating a calling application to an API D. capping nested query depth to prevent resource-exhaustion denial of service
5. Which term means: "static token identifying and authenticating a calling application to an API"? Junior A. API key B. API gateway C. GraphQL introspection abuse D. GraphQL query depth limiting
6. Which statement is correct? Junior A. API key — static token identifying and authenticating a calling application to an API B. API key — entry point that centralizes auth, rate limiting, and routing for backend APIs C. API key — Broken Object Level Authorization, the top API risk where an API fails to check object ownership D. API key — querying the GraphQL schema to map and probe an API's full attack surface
7. What is Input schema validation ? Junior A. validating an HMAC signature on inbound webhooks to confirm they came from the real sender B. rejecting API requests whose body or parameters do not match an expected schema C. Broken Function Level Authorization where a user invokes privileged operations they should not access D. querying the GraphQL schema to map and probe an API's full attack surface
8. Which term means: "rejecting API requests whose body or parameters do not match an expected schema"? Junior A. Input schema validation B. BOLA C. Webhook signature verification D. API gateway
9. Which statement is correct? Junior A. Input schema validation — capping how many requests a client may make in a window to curb abuse and brute force B. Input schema validation — rejecting API requests whose body or parameters do not match an expected schema C. Input schema validation — capping nested query depth to prevent resource-exhaustion denial of service D. Input schema validation — validating an HMAC signature on inbound webhooks to confirm they came from the real sender
10. What is API gateway ? Junior A. rejecting API requests whose body or parameters do not match an expected schema B. entry point that centralizes auth, rate limiting, and routing for backend APIs C. capping how many requests a client may make in a window to curb abuse and brute force D. signing API requests with a shared secret so the server can verify integrity and origin
11. Which term means: "entry point that centralizes auth, rate limiting, and routing for backend APIs"? Junior A. API gateway B. Rate limiting C. Request signing (HMAC) D. GraphQL introspection abuse
12. Which statement is correct? Junior A. API gateway — Broken Object Level Authorization, the top API risk where an API fails to check object ownership B. API gateway — entry point that centralizes auth, rate limiting, and routing for backend APIs C. API gateway — binding client JSON to internal fields the caller should not be able to set D. API gateway — an API returning more fields than the client needs, leaking sensitive data
13. What is BOLA ? Mid A. Broken Object Level Authorization, the top API risk where an API fails to check object ownership B. binding client JSON to internal fields the caller should not be able to set C. static token identifying and authenticating a calling application to an API D. querying the GraphQL schema to map and probe an API's full attack surface
14. Which term means: "Broken Object Level Authorization, the top API risk where an API fails to check object ownership"? Mid A. GraphQL introspection abuse B. Webhook signature verification C. API gateway D. BOLA
15. Which statement is correct? Mid A. BOLA — entry point that centralizes auth, rate limiting, and routing for backend APIs B. BOLA — capping how many requests a client may make in a window to curb abuse and brute force C. BOLA — Broken Object Level Authorization, the top API risk where an API fails to check object ownership D. BOLA — capping nested query depth to prevent resource-exhaustion denial of service
16. What is Excessive data exposure ? Mid A. an API returning more fields than the client needs, leaking sensitive data B. rejecting API requests whose body or parameters do not match an expected schema C. Broken Object Level Authorization, the top API risk where an API fails to check object ownership D. capping how many requests a client may make in a window to curb abuse and brute force
17. Which term means: "an API returning more fields than the client needs, leaking sensitive data"? Mid A. Mass assignment (API) B. Request signing (HMAC) C. Excessive data exposure D. BFLA
18. Which statement is correct? Mid A. Excessive data exposure — an API returning more fields than the client needs, leaking sensitive data B. Excessive data exposure — signing API requests with a shared secret so the server can verify integrity and origin C. Excessive data exposure — validating an HMAC signature on inbound webhooks to confirm they came from the real sender D. Excessive data exposure — querying the GraphQL schema to map and probe an API's full attack surface
19. What is Mass assignment (API) ? Mid A. capping nested query depth to prevent resource-exhaustion denial of service B. binding client JSON to internal fields the caller should not be able to set C. rejecting API requests whose body or parameters do not match an expected schema D. static token identifying and authenticating a calling application to an API
20. Which term means: "binding client JSON to internal fields the caller should not be able to set"? Mid A. Mass assignment (API) B. Rate limiting C. API key D. BOLA
21. Which statement is correct? Mid A. Mass assignment (API) — an API returning more fields than the client needs, leaking sensitive data B. Mass assignment (API) — capping how many requests a client may make in a window to curb abuse and brute force C. Mass assignment (API) — entry point that centralizes auth, rate limiting, and routing for backend APIs D. Mass assignment (API) — binding client JSON to internal fields the caller should not be able to set
22. What is GraphQL introspection abuse ? Mid A. entry point that centralizes auth, rate limiting, and routing for backend APIs B. querying the GraphQL schema to map and probe an API's full attack surface C. signing API requests with a shared secret so the server can verify integrity and origin D. binding client JSON to internal fields the caller should not be able to set
23. Which term means: "querying the GraphQL schema to map and probe an API's full attack surface"? Mid A. GraphQL query depth limiting B. API gateway C. Request signing (HMAC) D. GraphQL introspection abuse
24. Which statement is correct? Mid A. GraphQL introspection abuse — Broken Function Level Authorization where a user invokes privileged operations they should not access B. GraphQL introspection abuse — validating an HMAC signature on inbound webhooks to confirm they came from the real sender C. GraphQL introspection abuse — an API returning more fields than the client needs, leaking sensitive data D. GraphQL introspection abuse — querying the GraphQL schema to map and probe an API's full attack surface
25. What is BFLA ? Senior A. an API returning more fields than the client needs, leaking sensitive data B. static token identifying and authenticating a calling application to an API C. rejecting API requests whose body or parameters do not match an expected schema D. Broken Function Level Authorization where a user invokes privileged operations they should not access
26. Which term means: "Broken Function Level Authorization where a user invokes privileged operations they should not access"? Senior A. API key B. Request signing (HMAC) C. BFLA D. Mass assignment (API)
27. Which statement is correct? Senior A. BFLA — Broken Function Level Authorization where a user invokes privileged operations they should not access B. BFLA — an API returning more fields than the client needs, leaking sensitive data C. BFLA — static token identifying and authenticating a calling application to an API D. BFLA — capping nested query depth to prevent resource-exhaustion denial of service
28. What is GraphQL query depth limiting ? Senior A. Broken Function Level Authorization where a user invokes privileged operations they should not access B. entry point that centralizes auth, rate limiting, and routing for backend APIs C. capping nested query depth to prevent resource-exhaustion denial of service D. signing API requests with a shared secret so the server can verify integrity and origin
29. Which term means: "capping nested query depth to prevent resource-exhaustion denial of service"? Senior A. Webhook signature verification B. BOLA C. GraphQL query depth limiting D. BFLA
30. Which statement is correct? Senior A. GraphQL query depth limiting — Broken Function Level Authorization where a user invokes privileged operations they should not access B. GraphQL query depth limiting — capping nested query depth to prevent resource-exhaustion denial of service C. GraphQL query depth limiting — rejecting API requests whose body or parameters do not match an expected schema D. GraphQL query depth limiting — querying the GraphQL schema to map and probe an API's full attack surface Showing 30 of 36 API Security questions — the full set, with answers, explanations and an AI tutor on every question, is inside.