Google Professional Cloud Developer Question 357
Select 3Google Cloud PlatformYou are developing an API for your application and want to expose it securely using Apigee. The API must restrict access to authenticated users and ensure that sensitive data, like API keys, are not exposed during transmission. Which of the following steps should you take to secure your API using Apigee?
- A
Enable OAuth 2.0 authentication for API access.
- B
Use API Key verification policies to validate incoming requests.
- C
Deploy the API on a publicly accessible endpoint without encryption to simplify access.
- D
Implement TLS (HTTPS) to encrypt API traffic.
- E
Disable all security policies to improve performance.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure an API using Apigee, it is critical to implement robust authentication mechanisms like OAuth 2.0, validate incoming requests using API keys, and encrypt traffic using TLS (HTTPS). These measures ensure that only authorized users can access the API and that sensitive data remains protected during transmission. Avoid practices like disabling security policies or using unencrypted endpoints, as they create vulnerabilities.
- A. Correct.
Enabling OAuth 2.0 ensures that only authenticated users can access the API. OAuth 2.0 is a widely used standard for secure authorization.
- B. Correct.
API Key verification allows the API to validate client requests and ensures that unauthorized clients cannot access the API.
- C. Incorrect.
Deploying the API on a publicly accessible endpoint without encryption exposes sensitive data to potential interception, which is insecure.
- D. Correct.
TLS (HTTPS) encrypts API traffic, ensuring that sensitive information, such as API keys or user data, is not exposed during transmission.
- E. Incorrect.
Disabling all security policies would compromise the API's security and leave it vulnerable to attacks, which is not a best practice.