350-401 Question 261
Select 3An organization is designing a REST API to manage network devices. To ensure secure communication and authentication, which of the following best practices should be implemented?
- A
Use HTTPS for all API communications
- B
Implement basic authentication without encryption for simplicity
- C
Use OAuth 2.0 for authentication and authorization
- D
Include sensitive information like API keys in query parameters
- E
Validate and sanitize all input data to prevent injection attacks
- F
Enable Cross-Origin Resource Sharing (CORS) for all origins without restrictions
Show answer and explanation
Correct answers: A, C, E
Explanation
When designing REST APIs, security is a critical consideration. HTTPS ensures secure communication, OAuth 2.0 provides robust authentication and authorization, and validating input data prevents injection attacks. Avoid practices such as using basic authentication without encryption, exposing sensitive data in query parameters, or enabling unrestricted CORS, as these can introduce vulnerabilities to the API.
- A. Correct.
Correct: HTTPS ensures secure communication by encrypting data in transit, protecting it from eavesdropping and tampering.
- B. Incorrect.
Incorrect: Basic authentication without encryption exposes credentials in transit, making it insecure. It should always be combined with HTTPS or replaced by more secure methods like OAuth.
- C. Correct.
Correct: OAuth 2.0 is a widely used and secure framework for authentication and authorization, providing robust security for REST APIs.
- D. Incorrect.
Incorrect: Including sensitive information like API keys in query parameters is insecure as they can be logged or exposed in URLs.
- E. Correct.
Correct: Input validation and sanitization are essential to protect APIs from injection attacks and ensure data integrity.
- F. Incorrect.
Incorrect: Enabling unrestricted CORS can expose APIs to security risks. CORS should be configured to allow only trusted origins.