36 API Security questions from the Security bank, written for Indian campus drives and tech interviews. Every question has a verified answer and an AI-tutor explanation on placd.
Free to start: the 2-minute IT readiness check — six questions and a result.
A.Broken Object Level Authorization, the top API risk where an API fails to check object ownership
B.an API returning more fields than the client needs, leaking sensitive data
C.capping nested query depth to prevent resource-exhaustion denial of service
D.capping how many requests a client may make in a window to curb abuse and brute force
Answer + AI explanation with Pro
2. Which term means: "capping how many requests a client may make in a window to curb abuse and brute force"?
Junior
A.BFLA
B.Rate limiting
C.GraphQL introspection abuse
D.API gateway
Answer + AI explanation with Pro
3. Which statement is correct?
Junior
A.Rate limiting — binding client JSON to internal fields the caller should not be able to set
B.Rate limiting — capping how many requests a client may make in a window to curb abuse and brute force
C.Rate limiting — entry point that centralizes auth, rate limiting, and routing for backend APIs
D.Rate limiting — validating an HMAC signature on inbound webhooks to confirm they came from the real sender
Answer + AI explanation with Pro
4. What is API key?
Junior
A.querying the GraphQL schema to map and probe an API's full attack surface
B.binding client JSON to internal fields the caller should not be able to set
C.static token identifying and authenticating a calling application to an API
D.capping nested query depth to prevent resource-exhaustion denial of service
Answer + AI explanation with Pro
5. Which term means: "static token identifying and authenticating a calling application to an API"?
Junior
A.API key
B.API gateway
C.GraphQL introspection abuse
D.GraphQL query depth limiting
Answer + AI explanation with Pro
6. Which statement is correct?
Junior
A.API key — static token identifying and authenticating a calling application to an API
B.API key — entry point that centralizes auth, rate limiting, and routing for backend APIs
C.API key — Broken Object Level Authorization, the top API risk where an API fails to check object ownership
D.API key — querying the GraphQL schema to map and probe an API's full attack surface
Answer + AI explanation with Pro
7. What is Input schema validation?
Junior
A.validating an HMAC signature on inbound webhooks to confirm they came from the real sender
B.rejecting API requests whose body or parameters do not match an expected schema
C.Broken Function Level Authorization where a user invokes privileged operations they should not access
D.querying the GraphQL schema to map and probe an API's full attack surface
Answer + AI explanation with Pro
8. Which term means: "rejecting API requests whose body or parameters do not match an expected schema"?
Junior
A.Input schema validation
B.BOLA
C.Webhook signature verification
D.API gateway
Answer + AI explanation with Pro
9. Which statement is correct?
Junior
A.Input schema validation — capping how many requests a client may make in a window to curb abuse and brute force
B.Input schema validation — rejecting API requests whose body or parameters do not match an expected schema
C.Input schema validation — capping nested query depth to prevent resource-exhaustion denial of service
D.Input schema validation — validating an HMAC signature on inbound webhooks to confirm they came from the real sender
Answer + AI explanation with Pro
10. What is API gateway?
Junior
A.rejecting API requests whose body or parameters do not match an expected schema
B.entry point that centralizes auth, rate limiting, and routing for backend APIs
C.capping how many requests a client may make in a window to curb abuse and brute force
D.signing API requests with a shared secret so the server can verify integrity and origin
Answer + AI explanation with Pro
11. Which term means: "entry point that centralizes auth, rate limiting, and routing for backend APIs"?
Junior
A.API gateway
B.Rate limiting
C.Request signing (HMAC)
D.GraphQL introspection abuse
Answer + AI explanation with Pro
12. Which statement is correct?
Junior
A.API gateway — Broken Object Level Authorization, the top API risk where an API fails to check object ownership
B.API gateway — entry point that centralizes auth, rate limiting, and routing for backend APIs
C.API gateway — binding client JSON to internal fields the caller should not be able to set
D.API gateway — an API returning more fields than the client needs, leaking sensitive data
Answer + AI explanation with Pro
13. What is BOLA?
Mid
A.Broken Object Level Authorization, the top API risk where an API fails to check object ownership
B.binding client JSON to internal fields the caller should not be able to set
C.static token identifying and authenticating a calling application to an API
D.querying the GraphQL schema to map and probe an API's full attack surface
Answer + AI explanation with Pro
14. Which term means: "Broken Object Level Authorization, the top API risk where an API fails to check object ownership"?
Mid
A.GraphQL introspection abuse
B.Webhook signature verification
C.API gateway
D.BOLA
Answer + AI explanation with Pro
15. Which statement is correct?
Mid
A.BOLA — entry point that centralizes auth, rate limiting, and routing for backend APIs
B.BOLA — capping how many requests a client may make in a window to curb abuse and brute force
C.BOLA — Broken Object Level Authorization, the top API risk where an API fails to check object ownership
D.BOLA — capping nested query depth to prevent resource-exhaustion denial of service
Answer + AI explanation with Pro
16. What is Excessive data exposure?
Mid
A.an API returning more fields than the client needs, leaking sensitive data
B.rejecting API requests whose body or parameters do not match an expected schema
C.Broken Object Level Authorization, the top API risk where an API fails to check object ownership
D.capping how many requests a client may make in a window to curb abuse and brute force
Answer + AI explanation with Pro
17. Which term means: "an API returning more fields than the client needs, leaking sensitive data"?
Mid
A.Mass assignment (API)
B.Request signing (HMAC)
C.Excessive data exposure
D.BFLA
Answer + AI explanation with Pro
18. Which statement is correct?
Mid
A.Excessive data exposure — an API returning more fields than the client needs, leaking sensitive data
B.Excessive data exposure — signing API requests with a shared secret so the server can verify integrity and origin
C.Excessive data exposure — validating an HMAC signature on inbound webhooks to confirm they came from the real sender
D.Excessive data exposure — querying the GraphQL schema to map and probe an API's full attack surface
Answer + AI explanation with Pro
19. What is Mass assignment (API)?
Mid
A.capping nested query depth to prevent resource-exhaustion denial of service
B.binding client JSON to internal fields the caller should not be able to set
C.rejecting API requests whose body or parameters do not match an expected schema
D.static token identifying and authenticating a calling application to an API
Answer + AI explanation with Pro
20. Which term means: "binding client JSON to internal fields the caller should not be able to set"?
Mid
A.Mass assignment (API)
B.Rate limiting
C.API key
D.BOLA
Answer + AI explanation with Pro
21. Which statement is correct?
Mid
A.Mass assignment (API) — an API returning more fields than the client needs, leaking sensitive data
B.Mass assignment (API) — capping how many requests a client may make in a window to curb abuse and brute force
C.Mass assignment (API) — entry point that centralizes auth, rate limiting, and routing for backend APIs
D.Mass assignment (API) — binding client JSON to internal fields the caller should not be able to set
Answer + AI explanation with Pro
22. What is GraphQL introspection abuse?
Mid
A.entry point that centralizes auth, rate limiting, and routing for backend APIs
B.querying the GraphQL schema to map and probe an API's full attack surface
C.signing API requests with a shared secret so the server can verify integrity and origin
D.binding client JSON to internal fields the caller should not be able to set
Answer + AI explanation with Pro
23. Which term means: "querying the GraphQL schema to map and probe an API's full attack surface"?
Mid
A.GraphQL query depth limiting
B.API gateway
C.Request signing (HMAC)
D.GraphQL introspection abuse
Answer + AI explanation with Pro
24. Which statement is correct?
Mid
A.GraphQL introspection abuse — Broken Function Level Authorization where a user invokes privileged operations they should not access
B.GraphQL introspection abuse — validating an HMAC signature on inbound webhooks to confirm they came from the real sender
C.GraphQL introspection abuse — an API returning more fields than the client needs, leaking sensitive data
D.GraphQL introspection abuse — querying the GraphQL schema to map and probe an API's full attack surface
Answer + AI explanation with Pro
25. What is BFLA?
Senior
A.an API returning more fields than the client needs, leaking sensitive data
B.static token identifying and authenticating a calling application to an API
C.rejecting API requests whose body or parameters do not match an expected schema
D.Broken Function Level Authorization where a user invokes privileged operations they should not access
Answer + AI explanation with Pro
26. Which term means: "Broken Function Level Authorization where a user invokes privileged operations they should not access"?
Senior
A.API key
B.Request signing (HMAC)
C.BFLA
D.Mass assignment (API)
Answer + AI explanation with Pro
27. Which statement is correct?
Senior
A.BFLA — Broken Function Level Authorization where a user invokes privileged operations they should not access
B.BFLA — an API returning more fields than the client needs, leaking sensitive data
C.BFLA — static token identifying and authenticating a calling application to an API
D.BFLA — capping nested query depth to prevent resource-exhaustion denial of service
Answer + AI explanation with Pro
28. What is GraphQL query depth limiting?
Senior
A.Broken Function Level Authorization where a user invokes privileged operations they should not access
B.entry point that centralizes auth, rate limiting, and routing for backend APIs
C.capping nested query depth to prevent resource-exhaustion denial of service
D.signing API requests with a shared secret so the server can verify integrity and origin
Answer + AI explanation with Pro
29. Which term means: "capping nested query depth to prevent resource-exhaustion denial of service"?
Senior
A.Webhook signature verification
B.BOLA
C.GraphQL query depth limiting
D.BFLA
Answer + AI explanation with Pro
30. Which statement is correct?
Senior
A.GraphQL query depth limiting — Broken Function Level Authorization where a user invokes privileged operations they should not access
B.GraphQL query depth limiting — capping nested query depth to prevent resource-exhaustion denial of service
C.GraphQL query depth limiting — rejecting API requests whose body or parameters do not match an expected schema
D.GraphQL query depth limiting — querying the GraphQL schema to map and probe an API's full attack surface
Answer + AI explanation with Pro
Showing 30 of 36 API Security questions — the full set, with answers, explanations and an AI tutor on every question, is inside.
Free to start
Start with a free readiness check
Sign up free for the 2-minute IT readiness check and a scored result. Answers, explanations and the AI tutor on every API Security question come with Pro.