350-401 Question 260
Select 4A network administrator is designing a REST API-based solution to manage network devices. They are concerned about security and want to implement measures to ensure API communication is protected from unauthorized access and potential threats. Which of the following security measures should they implement to secure the REST API?
- A
Use HTTPS instead of HTTP for all API communication.
- B
Implement Basic Authentication with a hardcoded username and password.
- C
Use token-based authentication mechanisms like OAuth 2.0.
- D
Enforce rate limiting and API throttling.
- E
Disable encryption to improve API performance.
- F
Validate and sanitize all user inputs to prevent injection attacks.
Show answer and explanation
Correct answers: A, C, D, F
Explanation
To secure a REST API, it is essential to use HTTPS to encrypt communication, implement robust authentication mechanisms like OAuth 2.0 to ensure only authorized users can access the API, apply rate limiting to protect against abuse, and sanitize user inputs to prevent injection attacks. These measures collectively safeguard the API from common security threats and ensure secure operation.
- A. Correct.
Using HTTPS ensures that API communication is encrypted, protecting data in transit from being intercepted by attackers. This is a fundamental security measure for any REST API.
- B. Incorrect.
While Basic Authentication is a valid option, hardcoding credentials is a poor security practice as it exposes sensitive information and makes it difficult to rotate credentials. Therefore, this is not a recommended measure.
- C. Correct.
Token-based authentication mechanisms like OAuth 2.0 provide a secure and scalable method for authentication, allowing for token expiration and revocation, which enhances API security.
- D. Correct.
Rate limiting and API throttling help prevent abuse and protect the API from denial-of-service (DoS) attacks or excessive use of resources by malicious actors.
- E. Incorrect.
Disabling encryption compromises data security and exposes communication to eavesdropping and tampering. This is not a valid security measure.
- F. Correct.
Validating and sanitizing all user inputs is critical to prevent injection attacks, such as SQL injection or command injection, which could compromise the API or the underlying systems.