I85PREP
⌘ K
F5-401 Security Expert study materials
F5-401 Security Expert study resources

F5-401 Security Expert practice questions

One question at a time. Build your F5-401 Security Expert understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Application and API security architecture

In a threat model for a REST API, which element describes the trust boundary that must be analyzed when a mobile client calls the backend through a load balancer?

  1. The point where data crosses from a lower-trust client zone into the higher-trust server zone Correct answer.
  2. The HTTP status codes returned for failed authentication attempts
  3. The encrypted TLS session established between the client and the load balancer
  4. The database connection pool size configured on the application server

Explanation

A trust boundary is any point where data or control passes between components operating at different privilege or trust levels, such as a public client zone and an internal server zone. Threat modeling focuses analysis on these crossings because that is where spoofing and tampering risks concentrate. TLS sessions, pool sizes, and status codes are implementation details, not boundaries.

Question 2Application and API security architecture

Which HTTP response header instructs browsers to only send a site's cookies over encrypted connections, mitigating session hijacking on mixed-content pages?

  1. Content-Security-Policy
  2. X-Content-Type-Options
  3. Set-Cookie with the Secure attribute Correct answer.
  4. Strict-Transport-Security

Explanation

The Secure attribute on a cookie tells the user agent to transmit it only over HTTPS, preventing leakage over plaintext channels. HSTS forces HTTPS for the whole origin but does not itself mark cookies as secure. CSP and X-Content-Type-Options address script injection and MIME sniffing respectively.

Question 3Application and API security architecture

An API gateway is configured to validate JSON request bodies against a strict schema before forwarding them to microservices. Which security objective does this control primarily serve?

  1. Guaranteeing confidentiality of data at rest in the backend database
  2. Preventing injection and malformed-input attacks from reaching downstream services Correct answer.
  3. Providing non-repudiation of client transactions through digital signatures
  4. Enforcing rate limits per authenticated consumer

Explanation

Schema validation at the gateway rejects structurally invalid or unexpected input early, reducing the attack surface for injection and parser abuse in downstream services. It does not encrypt stored data, create signed evidence, or throttle requests. Those goals require separate controls such as encryption, signing, and quota enforcement.

Question 4Application and API security architecture

Which OAuth 2.0 grant type is appropriate for a single-page application that cannot keep a client secret confidential?

  1. Implicit grant with long-lived access tokens
  2. Resource owner password grant
  3. Client credentials grant
  4. Authorization code grant with PKCE Correct answer.

Explanation

The authorization code grant with PKCE binds the code exchange to a dynamically generated verifier, so a public client without a secret can obtain tokens safely. Client credentials are for machine-to-machine calls, and the password grant exposes user credentials to the client. The implicit grant is deprecated for browser apps because it leaks tokens in URLs.

Question 5Application and API security architecture

What is the primary security purpose of mutual TLS between two internal microservices?

  1. Load balancing requests across service replicas
  2. Authenticating both service identities and encrypting the channel Correct answer.
  3. Compressing request payloads to reduce bandwidth
  4. Caching authorization decisions at the service mesh layer

Explanation

Mutual TLS requires each side to present a valid certificate, so both services prove their identity while the channel is encrypted. This supports zero-trust service-to-service communication. Compression, caching, and load balancing are unrelated mesh functions.

Question 6Application and API security architecture

Which practice best protects secrets such as API keys from being committed to a source code repository?

  1. Encrypting the secrets file with a key stored in the same repository
  2. Base64-encoding the secrets before committing them
  3. Committing secrets only to a private branch that is later deleted
  4. Storing secrets in a dedicated secrets manager and injecting them at runtime Correct answer.

Explanation

A secrets manager centralizes storage, access control, rotation, and audit while keeping credentials out of version control. Encrypting with a key stored alongside the ciphertext, using temporary branches, or encoding values provides no real protection because the material remains recoverable from repository history.

Question 7Application and API security architecture

In an application architecture, which component is responsible for enforcing fine-grained authorization decisions such as whether a user may delete a specific record?

  1. The DNS resolver
  2. The content delivery network
  3. The TLS terminator
  4. The policy decision point consulted by the application Correct answer.

Explanation

A policy decision point evaluates authorization policies and returns decisions that the application enforces. Placing policy logic in a dedicated component improves consistency and auditability. TLS terminators, CDNs, and DNS resolvers handle transport, caching, and name resolution, not record-level permissions.

Question 8Application and API security architecture

Which input handling approach most effectively reduces the risk of SQL injection in a web application?

  1. Using parameterized queries with bound parameters Correct answer.
  2. Limiting input length to 64 characters
  3. Escaping single quotes in user input before concatenation
  4. Blocking requests that contain the word SELECT

Explanation

Parameterized queries separate SQL code from data, so user input cannot alter query structure regardless of its content. Manual escaping is error-prone, blocklists are bypassable, and length limits do not prevent injection.

Question 9Application and API security architecture

A team wants to detect when an attacker replays a captured API request that contains a valid bearer token. Which control most directly addresses replay?

  1. Increasing the token's signing key length
  2. Adding a longer Cache-Control max-age to responses
  3. Enabling gzip compression on API responses
  4. Requiring a short token lifetime combined with a server-tracked nonce or request timestamp Correct answer.

Explanation

Replay protection requires that a captured request cannot be reused, typically by binding it to a short validity window and a unique nonce the server tracks. Key length strengthens signature forgery resistance but does not stop reuse of a valid token. Caching and compression are unrelated to replay.

Question 10Application and API security architecture

An application stores user-uploaded files and serves them from the same origin as the web application. Which architectural change best reduces the risk of stored cross-site scripting through uploaded HTML files?

  1. Compressing uploaded files to reduce storage cost
  2. Renaming uploaded files to random UUIDs before storage
  3. Serving uploads from a separate sandboxed origin with a restrictive Content-Type and Content-Disposition Correct answer.
  4. Storing uploads in a database BLOB column instead of a filesystem

Explanation

Hosting user content on an isolated origin prevents scripts in uploaded files from accessing the main application's cookies and DOM, and forcing download disposition stops inline rendering. Renaming, compressing, or changing storage location does not neutralize active content.

Question 11Application and API security architecture

A microservice architecture uses a shared signing key across all services to validate JWTs. Which weakness does this design introduce?

  1. The tokens can no longer carry user claims
  2. Any compromised service can forge tokens accepted by every other service Correct answer.
  3. Latency increases because every service must call the issuer
  4. Tokens become unverifiable once the key rotates

Explanation

With symmetric signing, every holder of the key can both verify and mint tokens, so a single compromised service can impersonate any user to the whole estate. Asymmetric signing with private keys held only by the issuer limits forgery capability. Rotation and claim carriage remain possible, and validation is local rather than issuer-dependent.

Question 12Application and API security architecture

Which control best mitigates server-side request forgery in a feature that fetches a user-supplied URL to generate a preview?

  1. Logging every fetched URL for later review
  2. URL-encoding the supplied value before fetching
  3. Requiring the user to be authenticated before submitting a URL
  4. Validating the URL against an allowlist of approved domains and blocking private IP ranges after DNS resolution Correct answer.

Explanation

SSRF defense requires restricting destinations to trusted hosts and blocking internal address ranges, including after DNS resolution to defeat rebinding. Encoding, authentication, and logging reduce exposure or aid investigation but do not stop requests to internal services.

Question 13Application and API security architecture

A web application sets session cookies without the HttpOnly attribute. Which attack does this omission most directly enable?

  1. Downgrade of TLS to plaintext HTTP
  2. Cross-site request forgery against state-changing endpoints
  3. Theft of the session cookie via injected client-side script Correct answer.
  4. Brute forcing of user passwords

Explanation

Without HttpOnly, JavaScript running in the page, including injected script, can read document.cookie and exfiltrate the session identifier. CSRF is mitigated by anti-CSRF tokens or SameSite, not HttpOnly. TLS downgrade and password brute force are addressed by HSTS and lockout controls.

Question 14Application and API security architecture

In a zero-trust application architecture, which principle most accurately describes how internal service calls should be authorized?

  1. Authorization is performed once at login and cached for the session duration
  2. Every request is authenticated and authorized based on identity and context regardless of network origin Correct answer.
  3. Trust is granted based on network location inside the corporate perimeter
  4. Internal services rely on the gateway to authenticate and skip their own checks

Explanation

Zero trust removes implicit trust based on network position and requires per-request identity and context evaluation. Perimeter-based trust, login-time-only authorization, and delegated authentication without local checks all reintroduce implicit trust assumptions.

Question 15Application and API security architecture

Which approach best prevents insecure direct object reference in an API that returns invoice records by numeric identifier?

  1. Verifying on the server that the authenticated principal is authorized for the requested record Correct answer.
  2. Using unpredictable identifiers such as UUIDs as the sole control
  3. Relying on the client to hide invoice links it should not access
  4. Requiring HTTPS for all invoice requests

Explanation

Object-level authorization must be enforced server-side for each request, checking that the caller owns or may access the specific record. Unpredictable identifiers add obscurity but do not authorize access, and client-side hiding or transport encryption does not stop direct requests.

Question 16Application and API security architecture

Which design most effectively limits the blast radius of a compromised third-party JavaScript dependency loaded by a web application?

  1. Hosting the dependency on the application origin and granting it full cookie access
  2. Pinning the dependency version and disabling integrity checks
  3. Loading it in a sandboxed iframe on a separate origin with a restrictive Content-Security-Policy Correct answer.
  4. Minifying the dependency to reduce its size

Explanation

Isolating third-party code on a separate origin inside a sandboxed frame prevents it from reading application cookies or DOM, and CSP further constrains its capabilities. Same-origin hosting, disabled integrity checks, and minification do not contain a compromised library.

Question 17Application and API security architecture

A REST API must ensure that a client cannot modify the price field of an order after submission. Which control best addresses this mass-assignment risk?

  1. Encrypting the price in the response payload
  2. Validating that the price field is numeric
  3. Requiring the client to send a checksum of the price
  4. Binding only explicitly allowed fields to the domain object on the server Correct answer.

Explanation

Mass assignment occurs when client-supplied fields are bound directly to internal objects, letting attackers set sensitive properties. An allowlist of bindable fields ensures server-controlled values such as price cannot be overridden. Numeric validation, client checksums, and response encryption do not prevent unauthorized field updates.

Question 18Application and API security architecture

Which architecture best supports consistent enforcement of input validation and authentication across dozens of heterogeneous APIs?

  1. Relying on client applications to validate input before sending
  2. Embedding separate validation logic in each service with no shared standard
  3. Disabling validation in services that sit behind a firewall
  4. Routing traffic through a centralized API gateway that applies shared policies Correct answer.

Explanation

A centralized gateway applies uniform authentication and validation policies across heterogeneous services, reducing drift and gaps. Per-service logic without standards creates inconsistency, client-side validation is bypassable, and firewall placement is not an input control.

Question 19Application and API security architecture

Which property of a cryptographic signature on a security token allows a resource server to validate it without contacting the issuer?

  1. The token includes a timestamp
  2. The token is transmitted over TLS
  3. The signature is computed over the token header and payload using a key the verifier can use or has the corresponding public key for Correct answer.
  4. The signature is encrypted with the user's password

Explanation

A digital signature over the token contents lets any party with the appropriate verification key check integrity and origin locally. This is what enables stateless validation at resource servers. Password-based encryption, TLS, and timestamps do not by themselves provide verifiable issuer authenticity.

Question 20Application and API security architecture

An application uses a content security policy of default-src 'self'. Which residual risk remains that CSP alone does not eliminate?

  1. Inclusion of external scripts from unapproved domains
  2. Execution of inline event handlers
  3. Reflected cross-site scripting through DOM sinks that write attacker data into script contexts allowed by policy Correct answer.
  4. Loading of images from the application's own origin

Explanation

CSP restricts where code can load from, but DOM-based sinks that place attacker data into permitted execution contexts can still cause script execution. Inline handlers and unapproved external scripts are blocked by a strict default-src policy, and same-origin images are permitted by design.

Question 21Application and API security architecture

A service mesh enforces mTLS between workloads, but an attacker who compromises one workload's container can call other services. Which additional control most directly limits lateral movement?

  1. Rotating certificates more frequently
  2. Enabling verbose access logging on the mesh
  3. Service-level authorization policies that restrict which identities may call which endpoints Correct answer.
  4. Increasing the TLS key size on all certificates

Explanation

Identity-based authorization policies restrict which authenticated workloads may reach specific services, containing a compromised workload. Key size, logging, and rotation strengthen transport security and visibility but do not stop an already-authenticated compromised identity from calling permitted peers.

Question 22Application and API security architecture

An API issues access tokens with a 24-hour lifetime and no revocation mechanism. Which architectural change most improves the ability to respond to a stolen token?

  1. Adding a longer cache lifetime to token validation responses
  2. Shortening access token lifetime and introducing refresh tokens with rotation and revocation Correct answer.
  3. Increasing the token size to include more user claims
  4. Switching from HTTPS to mutual TLS for all clients

Explanation

Short-lived access tokens bound the window of misuse, while rotating refresh tokens with revocation let the authorization server cut off continued access. Larger tokens, transport changes, and longer caching do not reduce the exposure window and can worsen it.

Question 23Application and API security architecture

A team must protect a multi-tenant SaaS API so that tenant A can never read tenant B's data even if an application bug omits a filter. Which defense-in-depth design best achieves this?

  1. Combining row-level security in the database with tenant context propagated from the authenticated token Correct answer.
  2. Relying on separate database schemas without enforcing tenant identity in queries
  3. Enforcing tenant scoping in application code only, with code review as the safeguard
  4. Encrypting all tenant data with a single shared key

Explanation

Defense in depth requires both application-level scoping and database-enforced row-level security tied to a trusted tenant identity from the token, so a missing filter still cannot cross tenants. Code review alone is fallible, schema separation without identity checks still permits cross-tenant queries, and a shared key does not isolate tenants.

Question 24Application and API security architecture

Which threat is most specifically addressed by validating the aud and iss claims of a JWT at a resource server?

  1. Cross-site request forgery on cookie-based endpoints
  2. Brute forcing of the token signing key
  3. Token substitution, where a token issued for one service or issuer is replayed against another Correct answer.
  4. Denial of service through oversized request bodies

Explanation

Checking aud and iss ensures the token was intended for this resource server and issued by a trusted authority, blocking token substitution across services. Key brute force, CSRF, and payload size are mitigated by key strength, anti-CSRF controls, and request size limits.

Question 25Application and API security architecture

In a threat model, an attacker with read access to application logs could recover session identifiers if they are logged. Which design change best removes this exposure?

  1. Moving logs to a cheaper storage tier
  2. Redacting or hashing sensitive identifiers before they are written to logs Correct answer.
  3. Increasing log retention to improve investigation
  4. Adding more verbose request logging across all services

Explanation

Sensitive values such as session identifiers and tokens should be redacted or irreversibly hashed at the logging boundary so log readers cannot reuse them. Retention, storage tier, and increased verbosity affect cost and volume but not the exposure of secrets.

Question 26Application and API security architecture

In an application security architecture, which term describes the practice of building security controls directly into the software development lifecycle so that defects are found before deployment rather than by perimeter defenses afterward?

  1. Shift-left security Correct answer.
  2. Defense in depth
  3. Separation of duties
  4. Least privilege

Explanation

Shift-left security moves security activities such as threat modeling, static analysis, and dependency scanning earlier in the development lifecycle, so defects are fixed when they are cheapest to correct. The other options describe general security principles rather than the timing of security work within development.

Question 27Application and API security architecture

An API gateway is placed in front of several backend services. Which architectural benefit most directly justifies this placement for application security?

  1. It encrypts all database records at rest on behalf of the backend services
  2. It centralizes authentication and request validation so every service does not reimplement them Correct answer.
  3. It removes the need for any authorization checks inside the backend services
  4. It guarantees that backend services contain no exploitable vulnerabilities

Explanation

A gateway is a natural enforcement point where authentication, schema validation, and rate limiting can be applied consistently before requests reach heterogeneous services. It does not eliminate the need for service-level authorization, nor does it encrypt data at rest or guarantee vulnerability-free code.

Question 28Application and API security architecture

Which statement best describes the security purpose of applying the principle of least privilege to service accounts in an application architecture?

  1. Each service is granted broad permissions so that future features do not require changes
  2. Each service receives only the permissions required for its function, limiting damage if it is compromised Correct answer.
  3. Each service shares a single administrative account to simplify auditing across the platform
  4. Each service authenticates only with long-lived static passwords stored in configuration files

Explanation

Least privilege constrains each identity to the minimum rights needed, so a compromised service cannot reach resources outside its function. Shared administrative accounts, broad permissions, and static credentials all increase blast radius and weaken accountability.

Question 29Application and API security architecture

A web application architecture separates the browser-facing presentation tier from the data tier, and the presentation tier holds database credentials. Which design change most reduces the impact of a presentation-tier compromise?

  1. Increase the database account privileges so the presentation tier can handle all future queries
  2. Disable database query logging to reduce the volume of sensitive records produced
  3. Store the database credentials in the browser local storage for the frontend to use
  4. Introduce a service layer that mediates data access with narrowly scoped credentials Correct answer.

Explanation

Placing a mediating service between the presentation tier and the data store lets each layer hold only the credentials it needs, so a compromise of the front end does not yield direct database access. Broadening privileges or exposing credentials to the browser worsens the exposure.

Question 30Application and API security architecture

An organization wants to make authorization decisions consistent across a web application, a mobile backend, and several internal services. Which architectural approach best achieves this?

  1. Relying on the client application to hide interface elements that the user should not access
  2. A centralized policy decision point that services query, with policy enforcement points in each service Correct answer.
  3. Encoding authorization rules as comments in the API documentation for developers to follow
  4. Duplicating the authorization rules in each service and reviewing them annually for drift

Explanation

Separating policy decision from policy enforcement lets one authoritative policy engine serve all channels while each service still enforces decisions at its own boundary. Duplicated rules drift, and client-side hiding is never an authorization control.

Question 31Application and API security architecture

A team is designing an API that must accept file uploads. Which architecture most reduces the risk of a stored malicious file being executed on the application server?

  1. Store uploads in a directory served directly by the web server so downloads are fast and cacheable
  2. Store uploads in the application directory and rely on file extension filtering by the client
  3. Store uploads outside the web root in object storage and serve them only through a download handler that sets a safe content type Correct answer.
  4. Store uploads in the database and render them inline in the browser for user convenience

Explanation

Keeping uploaded content out of the executable web root and delivering it with a controlled content type prevents the server from interpreting the file as code. Direct serving, client-side filtering, and inline rendering all increase the chance of execution or script injection.

Question 32Application and API security architecture

An application uses short-lived access tokens plus rotating refresh tokens for its public API. Which property of this architecture most directly limits the damage from a stolen access token?

  1. The access token is signed with an asymmetric key
  2. The access token contains the user's role claims
  3. The refresh token is stored in the same client as the access token
  4. The access token expires quickly, so the window of misuse is bounded Correct answer.

Explanation

A short validity period bounds how long a captured access token remains usable, which is the main mitigation when the token cannot be individually revoked. Signing, role claims, and refresh token placement do not by themselves shorten that exposure window.

Question 33Application and API security architecture

A security architect must prevent an attacker who obtains a valid low-privilege token from invoking administrative API operations. Which control is most appropriate?

  1. Obfuscate administrative endpoint paths so they are hard to guess
  2. Use a longer token lifetime so administrators do not need to reauthenticate
  3. Rely on the API documentation to indicate which endpoints are administrative
  4. Enforce authorization on each endpoint based on the token's scopes and the caller's role Correct answer.

Explanation

Server-side authorization that checks scopes and roles on every endpoint ensures that possession of a valid token is not sufficient for privileged operations. Obfuscation, documentation, and token lifetime do not constrain what a caller is permitted to do.

Question 34Application and API security architecture

A microservice platform uses a service mesh that provides mutual TLS between workloads. Which additional architecture is needed to prevent a compromised workload from calling services outside its intended function?

  1. A shared service account used by all workloads to simplify certificate management
  2. Encryption of service configuration files at rest on each node
  3. Longer certificate validity periods for each workload's client certificate
  4. Workload identity with authorization policy that restricts which service identities may call which endpoints Correct answer.

Explanation

Mutual TLS authenticates workloads but does not decide what each authenticated workload may call; that requires per-identity authorization policy tied to the workload identity. Longer certificate lifetimes, configuration encryption, and shared accounts do not restrict call permissions.

Question 35Application and API security architecture

An application must integrate a partner's web front end with its own API using OAuth 2.0. Which grant type is appropriate for a confidential server-side client acting on behalf of a user?

  1. Authorization code with PKCE Correct answer.
  2. Implicit
  3. Client credentials
  4. Resource owner password credentials

Explanation

The authorization code grant, with PKCE for added protection, is the appropriate flow when a client acts on behalf of a user and can keep a secret. Client credentials is for machine-to-machine calls without a user, while implicit and password grants are deprecated for this purpose.

Question 36Application and API security architecture

A team is choosing between storing session state on the server and issuing self-contained tokens to browsers. Which consideration most favors server-side session state for a high-security application?

  1. The session identifier can be shorter than a JWT
  2. The server avoids the need to sign any data
  3. The server can revoke a session immediately by deleting the stored record Correct answer.
  4. The token payload can be read by the browser

Explanation

Because the server holds the authoritative session record, revocation takes effect at once, whereas a self-contained token remains valid until it expires unless additional revocation infrastructure exists. The other options are not security advantages of server-side sessions.

Question 37Application and API security architecture

An application relies on a content security policy that blocks inline scripts. An attacker gains the ability to inject markup into a page. Which residual risk remains despite the policy?

  1. The policy guarantees that injected scripts will never execute under any circumstance
  2. The policy prevents any markup injection from affecting the page at all
  3. The policy encrypts the injected markup so it cannot be interpreted
  4. Injected markup can still alter page content and exfiltrate data through permitted channels such as image requests Correct answer.

Explanation

A content security policy restricts script execution sources but does not prevent markup injection itself, and data can still leave through allowed request destinations or DOM manipulation. It is a mitigation layer, not a substitute for output encoding.

Question 38Application and API security architecture

A security architect is reviewing an architecture in which the web tier, application tier, and database tier all reside on a single host. Which change most improves the architecture's resistance to lateral movement after an initial compromise?

  1. Add a web application firewall in front of the combined host
  2. Rotate the database password on a fixed schedule
  3. Increase logging verbosity on the single host to capture attacker activity
  4. Segment the tiers onto separate hosts with network policy allowing only the required flows between them Correct answer.

Explanation

Separating tiers onto distinct hosts with restrictive network policy means a compromise in one tier does not automatically grant access to the others. A WAF, verbose logging, and password rotation add detection or credential hygiene but do not remove the shared-host lateral path.

Question 39Application and API security architecture

A multi-tenant API stores all tenants' records in one database table. Which architectural control most reliably prevents cross-tenant data disclosure caused by a missing filter in application code?

  1. Encrypting tenant records with a key shared across all tenants
  2. Row-level security enforced by the database using a tenant identifier bound to the authenticated session Correct answer.
  3. A convention that every query includes a tenant filter, verified during code review
  4. Separate database schemas per tenant selected by a query parameter supplied by the client

Explanation

Enforcing tenant isolation in the database with a session-bound tenant identifier provides a backstop that holds even when application code omits a filter. Conventions, client-supplied selectors, and shared keys all depend on correct application behavior or fail to isolate tenants.

Question 40Application and API security architecture

An organization wants to detect misuse of its public API by a compromised client credential. Which architecture provides the strongest signal while limiting impact?

  1. IP allowlisting as the sole authentication mechanism for all clients
  2. A single shared API key distributed to all clients with a global rate limit
  3. Per-client credentials with anomaly-based rate and behavior monitoring that can revoke a single client Correct answer.
  4. Credentials embedded in the mobile application binary with no rotation

Explanation

Unique credentials per client allow anomalous behavior to be attributed and contained by revoking only the affected client. Shared keys, embedded static secrets, and IP-only controls prevent attribution and force broad or ineffective responses.

Question 41Web application and API protection (WAF, API security, bot management, DDoS protection)

In a web application firewall deployment, what is the primary operational difference between positive (allowlist) security modeling and negative (blocklist) security modeling?

  1. Positive modeling blocks traffic matching known-bad signatures, whereas negative modeling permits only traffic matching known-good definitions.
  2. Positive modeling permits only traffic matching known-good definitions, whereas negative modeling blocks traffic matching known-bad signatures. Correct answer.
  3. Positive modeling requires TLS termination, whereas negative modeling operates only on unencrypted HTTP.
  4. Positive modeling inspects only response bodies, whereas negative modeling inspects only request headers.

Explanation

Positive security modeling defines what is allowed and rejects everything else, giving tight control but requiring accurate knowledge of legitimate traffic. Negative security modeling starts from permissive defaults and blocks only traffic that matches known attack signatures, so it is easier to deploy but can miss novel attacks.

Question 42Web application and API protection (WAF, API security, bot management, DDoS protection)

Which HTTP response status code is most appropriate for a WAF or API gateway to return when it blocks a request because the client exceeded its configured rate limit?

  1. 429 Correct answer.
  2. 401
  3. 403
  4. 503

Explanation

HTTP 429 Too Many Requests is defined specifically for signaling that a client has sent too many requests in a given amount of time. It lets well-behaved clients back off and distinguishes throttling from authentication or authorization failures.

Question 43Web application and API protection (WAF, API security, bot management, DDoS protection)

An API uses opaque bearer tokens in the Authorization header. Which control most directly limits the damage if a single token is stolen?

  1. Adding a server banner suppression rule
  2. Increasing the token's character length
  3. Setting a short token lifetime with refresh Correct answer.
  4. Enabling HTTP/2 on the API endpoint

Explanation

Short-lived access tokens bound the window in which a stolen credential remains usable, and refresh flows let legitimate clients continue working. Token length and transport or banner hardening do not reduce the exposure window of a leaked credential.

Question 44Web application and API protection (WAF, API security, bot management, DDoS protection)

What distinguishes a volumetric DDoS attack from an application-layer (Layer 7) DDoS attack?

  1. Volumetric attacks are mitigated only by WAF rules, while Layer 7 attacks are mitigated only by scrubbing centers.
  2. Volumetric attacks consume bandwidth or packet-processing capacity, while Layer 7 attacks exhaust server or application resources with expensive-looking requests. Correct answer.
  3. Volumetric attacks target DNS infrastructure only, while Layer 7 attacks target web servers only.
  4. Volumetric attacks always originate from a single source, while Layer 7 attacks always use botnets.

Explanation

Volumetric attacks flood the network with raw traffic measured in bits or packets per second, aiming to saturate links. Application-layer attacks use seemingly legitimate requests that are cheap to send but costly to process, so they can succeed with far lower traffic volume.

Question 45Web application and API protection (WAF, API security, bot management, DDoS protection)

Which mechanism is designed to distinguish automated clients from human users by collecting behavioral and environmental signals during a session?

  1. Bot management Correct answer.
  2. Content Security Policy
  3. Certificate pinning
  4. Schema validation

Explanation

Bot management solutions gather signals such as mouse movement, timing, fingerprint consistency, and challenge responses to classify clients as human or automated. The other options address input structure, transport trust, or browser content restrictions rather than client classification.

Question 46Web application and API protection (WAF, API security, bot management, DDoS protection)

In the context of API security, what does the term shadow API refer to?

  1. An API whose responses are cached by a CDN
  2. An API that is only accessible over a private network
  3. An API endpoint that exists and is reachable but is not documented or governed Correct answer.
  4. An API that returns responses in shadow mode without logging

Explanation

Shadow APIs are live endpoints that fall outside the documented inventory and therefore escape normal review, testing, and policy enforcement. Discovering them is a core goal of API discovery features in modern security platforms.

Question 47Web application and API protection (WAF, API security, bot management, DDoS protection)

What is the primary purpose of a challenge page (such as a JavaScript or CAPTCHA interstitial) in bot mitigation?

  1. To terminate TLS closer to the client
  2. To force the client to prove it can execute or solve something a simple script typically cannot Correct answer.
  3. To compress response bodies for faster delivery
  4. To encrypt the session cookie before it reaches the browser

Explanation

Challenges impose a task that ordinary browsers handle but naive automated scripts usually fail, allowing the defender to separate likely humans from bots. The result is typically a clearance cookie that lets the client proceed without repeated challenges.

Question 48Web application and API protection (WAF, API security, bot management, DDoS protection)

Which statement best describes the role of a scrubbing center in DDoS protection?

  1. It replaces the origin server by serving cached static content.
  2. It issues client certificates to legitimate users.
  3. It permanently stores all inbound traffic for forensic review.
  4. It diverts traffic away from the origin, filters malicious volume, and forwards clean traffic back. Correct answer.

Explanation

Scrubbing centers are diversion points where traffic is analyzed and attack traffic is dropped before clean traffic is forwarded to the protected origin. They are typically activated via routing changes such as BGP announcements or DNS steering.

Question 49Web application and API protection (WAF, API security, bot management, DDoS protection)

A security team wants the WAF to inspect JSON request bodies for API calls. Which configuration element must be enabled for body inspection to occur?

  1. Response body buffering
  2. Cookie encryption
  3. HTTP method override support
  4. Request body parsing with an appropriate size limit Correct answer.

Explanation

To inspect payloads, the WAF must parse the request body and buffer up to a configured maximum size; content beyond that limit may be skipped or cause the request to be rejected. Enabling body parsing without a sensible size limit can also create a resource-exhaustion risk.

Question 50Web application and API protection (WAF, API security, bot management, DDoS protection)

An API gateway enforces rate limits per API key. An attacker rotates through thousands of free-tier keys to exceed the intended global capacity. Which additional control best addresses this evasion?

  1. Limiting by client IP or account in addition to API key Correct answer.
  2. Switching the API to HTTP instead of HTTPS
  3. Increasing the per-key limit
  4. Disabling API key authentication

Explanation

Key rotation defeats limits that key solely on the credential, so defenders add dimensions such as source IP, account, or device fingerprint to aggregate abusive traffic. Layering limits makes it costlier for an attacker to spread requests across many identities.