My Courses Resources Automated API
Scanner Search
APIsec Certified Practitioner
/
Modules
/
APIsec Certified Practitioner
/
The ACP Exam
Quiz
The ACP Exam
You passed the quiz.
Score
93%
Correct
93/100
View resultsRetake quiz
APIsec Certified Practitioner
4 Lessons
1
Introduction to the ACP
2
ACP - Rules and Requirements
3
The ACP Exam
4
What's Next
Mark As Complete
The ACP Exam
APIsec Certified Practitioner
© 2025 Kajabi
The ACP Exam
Close
Loading...
You passed the quiz.
Score
93%
Correct
93/100
Loading...
Question 1
What is the primary difference between authentication and authorization?
Authentication is a part of token issuance, while authorization is independent of tokens
Authentication determines permissions, while authorization confirms identity
Authentication is used for user logins, while authorization is used exclusively for APIs
Authentication verifies the identity, while authorization controls data/function access
Correct answer.
Question 2
What is a typical vulnerability described by "Broken Function Level Authorization"?
API endpoints that are too exposed, allowing unauthorized access to business-critical workflows
Incorrect.
Failure to properly manage API inventory and documentation, exposing Admin endpoints
Attackers exploiting weak encryption algorithms to decrypt Admin functions
Complex access control policies that allow attackers to gain unauthorized access to user resources or
administrative functions
Question 3
Which tool was mentioned as useful for enforcing writing style guidelines in technical
documentation?
BurpSuite
Vale
Correct answer.
GitHub Pages
mitmweb2proxy
Question 4
Why is it important to define allowed parameters in your API specification regarding file paths?
To ensure easier debugging during development
To allow directory listings for troubleshooting
To filter and restrict inputs early, preventing invalid file access
Correct answer.
To increase the flexibility of file access
Question 5
When was the first edition of the OWASP API Security Top 10 released?
2017
2019
Correct answer.
2021
2023
Question 6
CORS stands for:
Content-Origin Restriction System
Cross-Origin Resource Sharing
Correct answer.
Centralized Object Resource Sharing
Cookie-Oriented Resource Security
Question 7
The Capital One breach was primarily caused by which type of vulnerability?
Broken Authentication due to missing credentials
Broken Function Level Authorization
Improper Inventory Management of APIs
SSRF, which exploited misconfigured WAF
Correct answer.
Question 8
What is the “phantom token flow” as described in the course?
Where the gateway converts an opaque token into a JWT
Correct answer.
A technique for embedding multiple tokens in one request
A process for refreshing tokens without user interaction
A method to bypass token validation
Question 9
Which HTTP status code is commonly used to indicate that too many requests have been made?
200
404
429
Correct answer.
500
Question 10
Why is it important for API documentation to cater to a broad audience?
So that all levels of technical developers can use the API
To ensure both technical and non-technical stakeholders can understand the API
Correct answer.
To make the API more difficult to hack
So potential customers can understand your product without help
Question 11
Why should cookies be treated as untrusted user data?
Because they are stored on a secure server
Because attackers can modify, forge, or harvest cookie data
Correct answer.
Because they are always encrypted and safe
Because they cannot be parsed by the server
Question 12
What does the phrase “Developers try, and business buys” imply?
Only technical documentation matters, not business documentation
Developers are the ones who ultimately decide on purchasing the product
A great developer experience through clear docs can drive overall business adoption
Correct answer.
Business leaders are responsible for testing the API
Question 13
How do proof-of-possession (POP) tokens differ from bearer tokens?
POP tokens require the sender to prove possession, making them bound to a specific client
Bearer tokens always require an additional PIN code
Bearer tokens use asymmetric signing, while POP tokens use symmetric signing
POP tokens are inherently unencrypted
Incorrect.
Question 14
How does TLS (Transport Layer Security) contribute to API security?
It automatically issues tokens to users
It proves the server’s and client’s identities over an encrypted channel
Correct answer.
It sends the private key over the network for verification
It replaces the need for any token-based authentication
Question 15
How can multimedia elements (e.g., videos, diagrams) enhance API documentation?
By making complex concepts clearer
Correct answer.
By automatically updating the API specs
By completely replacing written content
By reducing the need for error handling details
Question 16
Which of the following is NOT a common cause of a path traversal vulnerability?
Allowing user input to specify a file path without proper sanitization
Using relative paths instead of absolute paths to access files
Implementing strict input validation
Correct answer.
Failure to properly validate file extensions or types before processing them
Question 17
Unsafe Consumption of APIs focuses primarily on which of the following?
Mitigating risks from third-party API data
Correct answer.
Strengthening API provider defenses
Enhancing performance of API endpoints
Documenting API endpoints more clearly
Question 18
Which programming construct, if misused, can lead to unintentional error disclosure?
Switch-case statements
Try-catch blocks
Correct answer.
Conditional statements
For loops
Question 19
What is the primary purpose of implementing rate limiting on an API?
To increase the number of allowed simultaneous connections
To reduce server latency by caching all responses
To block all unauthorized users from accessing the API
To prevent overloading the server and mitigate DoS attacks
Correct answer.
Question 20
What is the primary risk associated with Broken Authentication (OWASP Top 10, A2)?
Users' passwords are stored in plaintext, making them vulnerable to exposure
Attackers may gain access to sensitive data through misconfigured permissions
API endpoints can be accessed without verifying the identity of the user
Attackers can bypass authentication mechanisms to impersonate users and steal sensitive
information
Correct answer.
Question 21
The Instagram password reset flaw is an example of which vulnerability?
Unrestricted Access to Sensitive Business Flows
Broken Object Level Authorization
Security Misconfiguration
Broken Authentication
Incorrect.
Question 22
Which is NOT a use case for API Documentation?
To examine logs from a previous version of the API
Correct answer.
To provide pen-testers with information necessary to craft attack scenarios
To provide a guide for integrating with third-party services
To explain the security features and protections of an API
Question 23
The Peloton breach example demonstrated which API vulnerability?
SSRF (Server Side Request Forgery)
Broken Function Level Authorization
Broken Authentication due to unsecured endpoints
Correct answer.
Unsafe Security Misconfiguration in server settings of APIs
Question 24
What is recommended when consuming data from third-party APIs?
Trust the third-party API data implicitly
Treat third-party APIs with same security as internally-developed
Correct answer.
Use unsecured connections to speed up data transfer
Avoid validating third-party data to reduce latency
Question 25
Which API security risk involves a lack of safeguards to prevent excessive resource use, potentially
leading to denial of service or high operational costs?
Unrestricted Resource Consumption
Correct answer.
Security Misconfiguration
Broken Object Level Authorization
Improper Inventory Management
Question 26
What is a key benefit of using a spec-driven approach (e.g., OpenAPI) for API documentation?
It helps keep the documentation in sync with the actual API
Correct answer.
It makes it easier to connect to automated scanning tools
It allows new engineers to understand the API more quickly
It removes the need for any developer reviews
Question 27
Which organization is responsible for publishing the API Security Top 10?
PortSwigger
ISO (International Organization for Standardization)
OWASP (Open Worldwide Application Security Project)
Correct answer.
NIST (National Institute of Standards and Technology)
Question 28
Which of the following tools is mentioned as useful for detecting security misconfigurations in APIs?
Man In The Middle Web
OWASP ZAP
Correct answer.
HTTPX
Burp Decoder
Question 29
In the context of API documentation, what does “governance” refer to?
A government regulation for API usage
The process of writing code for the API endpoints
The enforcement of standards and processes to ensure consistency and security
Correct answer.
A tool used to generate code samples
Question 30
What does the Secure flag on a cookie ensure?
It encrypts the cookie’s contents on the client machine
It ensures the cookie is only sent over HTTPS connections
Correct answer.
It makes the cookie accessible across all protocols
It prevents the cookie from being modified by the server
Question 31
Which of the following correctly lists the three parts of a JSON Web Token (JWT)?
Header, Payload, Signature
Correct answer.
Key, Payload, Algorithm
Identity, Claims, Metadata
Header, Body, Footer
Question 32
What is a common example of Improper Inventory Management in API security?
Outdated or retired API versions in production
Correct answer.
API endpoints exposing excessive data in responses
API endpoints using predictable identifiers
API endpoints with missing token validation
Question 33
Which HTTP status code is typically used to indicate a client error?
200
302
400
Correct answer.
500
Question 34
When an API needs to call another API using the received token, which of the following strategies
can be employed?
By generating a completely new token from scratch without any relation to the original
Only by performing a token exchange every time
By exchanging the token, embedding a nested token, or sharing the original token
Correct answer.
Only by directly sharing the same token across APIs
Question 35
What does "Unrestricted Resource Consumption" refer to in the context of API security?
APIs exposing sensitive data in responses that can be accessed by unauthorized users
Failure to implement proper API versioning, leading to compatibility issues
Weak authentication mechanisms allowing attackers to impersonate users
Attackers exploiting APIs to consume bandwidth, CPU, and memory, leading to DoS or increased
costs
Correct answer.
Question 36
Why might traditional web application scanners miss many API vulnerabilities?
They focus common vulnerabilities, not logic flaws
Correct answer.
They primarily scan for encryption issues
They do not check for the existence of APIs
They primarily test for network connectivity issues
Question 37
Rate limiting is important for controlling resource consumption because it:
Prevents unauthorized access to sensitive endpoints
Helps control server load and reduces costs by preventing abuse
Correct answer.
Automatically adjusts server capacity to handle traffic spikes
Ensures that all requests are processed in the order they are received
Question 38
Broken Object Property Level Authorization (sometimes called BOPLA) deals with which of the
following issues?
APIs lacking any authentication
APIs using weak encryption protocols
APIs returning excessive data
Correct answer.
APIs with no rate limiting in place
Question 39
Why is CORS ineffective against direct API attacks?
Because it is enforced by browsers, not when an API is accessed directly
Correct answer.
Because it requires additional encryption to work
Because it only blocks HTTP methods like GET and POST
Because it only applies to mobile applications
Question 40
What vulnerability is illustrated by the Trello example?
Security Misconfiguration in user credential checks
Broken Object Property Level Authorization
Incorrect.
Unrestricted Resource Consumption
Broken Authentication
Question 41
What type of vulnerability is characterized by an API allowing users to perform functions (such as
transferring funds) that should be restricted to higher-privileged roles?
Broken Function Level Authorization
Correct answer.
Unrestricted Resource Consumption
Server Side Request Forgery
Broken Authentication
Question 42
Why should error messages sent to end users be generic?
To ensure error messages are logged in detail
To avoid revealing sensitive internal information that attackers could exploit
Correct answer.
To confuse legitimate users
To allow easier debugging by external parties
Question 43
What is one major risk associated with outdated API documentation?
Authentication flows can be left exposed
API keys can potentially be left exposed in the old documentation
It will fail to automatically update with the latest API changes
It can lead to confusion and errors when the docs do not match the API’s actual behavior
Correct answer.
Question 44
What issue does “Improper Inventory Management” refer to in API security?
APIs that are too difficult to test
Organizations having incomplete view of all APIs
Correct answer.
APIs that return too much data
APIs that lack proper authentication controls
Question 45
Which three high-level types of API documentation were highlighted in the course?
Tutorials, white papers, and academic articles
API reference material, conceptual overviews, and workflow guides
Correct answer.
API Example Documents, specified deep dives, and performance metrics
API reference guidelines, best practice frameworks, and OAS blueprints
Question 46
What does the vulnerability “Broken Object Level Authorization (BOLA)” primarily refer to?
Exposing too much data in API responses
Lack of proper rate limiting
User A ability to access a User B resource
Correct answer.
Failure to authenticate users
Question 47
The Experian example highlighted a failure in which area?
Broken Object Level Authorization among users
Security Misconfiguration that allowed unauthorized API access
Correct answer.
Unrestricted Resource Consumption through excessive requests
Broken Authentication due to weak passwords
Question 48
Which mitigation is recommended to prevent Broken Object Level Authorization vulnerabilities?
Using sequential and predictable resource IDs
Implementing server-side authorization controls with unpredictable identifiers
Correct answer.
Relying on client-side authorization checks
Enabling input checks in the application UI
Question 49
How does CORS enhance security in web applications?
By blocking all external API requests
By disabling client-side scripting
By encrypting all data sent between client and server
By allowing browsers to restrict requests from unauthorized origins
Correct answer.
Question 50
Documenting an API early in the development process primarily helps with which of the following?
Guaranteeing that the final product is bug-free
Enabling early feedback, security reviews, and identifying issues before production
Correct answer.
Preventing any future changes to the API
Eliminating the need for developer testing
Question 51
Which answer best describes how Basic Authentication is achieved?
It uses digital certificates to authenticate the user
It sends a username and password (encoded in base64) in the HTTP authorization header
Correct answer.
It relies on a third-party token issuer
It sends an encrypted token in the HTTP header
Question 52
Which HTTP header is most commonly exploited to reveal the underlying web server technology?
Date
Content-Type
Cache-Control
Server
Correct answer.
Question 53
In OAuth, what is the main function of the Authorization Server?
It directly hosts the API resources
It stores client credentials permanently
It issues tokens to clients
Correct answer.
It acts as a proxy for TLS connections
Question 54
What is one primary benefit of including interactive “Try it!” features in API docs?
It gives ethical hackers ways to verify their attacks
It allows developers to see how an API interacts with their organization
Incorrect.
It helps developers connect the front end to the API
It allows developers to simulate API calls and see live responses
Question 55
Which of the following are identified as the three pillars of API Security?
Testing, Development, Documentation
Authentication, Authorization, Encryption
Governance, Monitoring, Testing
Correct answer.
Identification, Authentication, Accountability
Question 56
What is the primary role of an API key in API authentication?
To serve as both the username and password in one string for identification
To identify the application (machine identity) making the request
Correct answer.
To provide end-to-end encryption for API requests
To verify the user’s identity and role
Question 57
During the API design phase, what best practice is recommended to help prevent security
vulnerabilities?
Address documentation after code complete to speed up deployment
Focus primarily on performance testing
Utilize the user interface to filter data
Involve security teams early
Correct answer.
Question 58
What is the primary security risk of a Server-Side Request Forgery (SSRF) attack?
It enables unauthorized requests to internal services and networks
Correct answer.
It injects malicious JavaScript into web pages
It allows an attacker to force a user to reset their password
It corrupts database entries by altering API responses
Question 59
What is a key advantage of token-based authentication over basic authentication in API security?
Tokens can expire and carry additional authorization details
Correct answer.
It requires users to enter their credentials on every request
It uses a simpler mechanism that always relies on API keys
Tokens eliminate the need for TLS encryption
Question 60
Which string pattern is most commonly used by attackers in path traversal exploits?
""
"../"
Correct answer.
“HTTP/1.1"
“SELECT *”
Question 61
Which of the following is an example of an Injection vulnerability as described in the OWASP Top 10?
A mobile app using weak password hashing algorithms
A web application failing to check input for SQL commands, allowing an attacker to manipulate
database queries
Correct answer.
An application accepting API requests without proper authentication checks
A user logging in without any encryption, exposing login credentials
Question 62
In the Venmo example, what mistake led to excessive data exposure?
The API endpoint used incremental IDs
The API employed outdated encryption methods
The API had incorrect URL mappings
The API did not limit the fields returned
Correct answer.
Question 63
What is the main difference between a “by reference” token and a “by value” token?
By value tokens are only used for client credentials
By value tokens are self contained, while by reference tokens require an introspection call
Incorrect.
By reference tokens are always encrypted; by value tokens are not
By reference tokens are self-contained, while by value tokens require an introspection call
Question 64
Unsafe Consumption of APIs is mostly associated with risks from:
APIs with no rate limiting controls
APIs with outdated documentation
Over permissioned internal APIs
Third-party APIs that are insecure or improperly integrated
Correct answer.
Question 65
How does a Server-Side Request Forgery (SSRF) attack typically exploit an application?
By tricking the server into making requests to unintended URLs, such as internal services
Correct answer.
By injecting malicious SQL queries into API requests
By forcing the client to download a malicious script
By redirecting users to a phishing website through a spoofed domain
Question 66
What is a potential drawback of using hand-curated documentation instead of a spec-driven
approach?
It won’t include the correct parameters for all of the listed endpoints
It’s more likely to have an out-dated API removed on re-release
It requires no technical knowledge to maintain
It may not easily integrate with automated tools or remain in sync with the API
Correct answer.
Question 67
What does “error disclosure” refer to in API security?
Providing overly detailed error information that may aid attackers
Correct answer.
Logging errors solely for internal use
Using error messages to assist in user authentication
Hiding all error messages from users
Question 68
What is the purpose of PKCE (Proof Key for Code Exchange) in the OAuth authorization code flow?
To authenticate the resource owner directly
To replace the need for a client secret
To bind the authorization request and token request together
Correct answer.
To encrypt the token payload
Question 69
Which of the following professions would benefit most from understanding the OWASP API Top 10?
Developers, to help them write cleaner, more organized code
UI/UX designers, to understand how security issues may impact the user experience
Business leaders, to support strategic decision making
Penetration testers, to identify and exploit vulnerabilities in APIs
Correct answer.
Question 70
What is a characteristic of Broken Object Level Authorization (BOLA) vulnerabilities?
Objects within an API are not properly authenticated, allowing any user to access them
API endpoints fail to validate data inputs, leading to potential data breaches
Authentication credentials are stored insecurely, making them vulnerable to theft
Attackers can manipulate object identifiers to access unauthorized resources or perform actions
outside their authorization level
Correct answer.
Question 71
In the Coinbase example, what was the primary issue that allowed a hacker to sell Ethereum as
Bitcoin?
A missing logic validation check on the asset ID
Correct answer.
Overly strict rate limiting
The absence of authentication on the API
Exposing the API documentation publicly
Question 72
What role does a gateway play in API security?
It replaces the authorization server
It generates new tokens for every API call
It inspects requests, validates tokens, and enforces authorization
Correct answer.
It stores all user credentials
Question 73
In a BOLA vulnerability, what is the main security issue?
Excessive logging of API requests
Inadequate authorization checks on API resource access
Correct answer.
Weak password policies
Overly strict input sanitization
Question 74
Which statement best describes the primary role of APIs in modern applications?
They enforce security protocols on all traffic generated by users
They allow the user to communicate with the UI of an application
They serve as a bridge for communication between systems and devices
Correct answer.
They safely transport secure data to end users
Question 75
Which role is particularly valuable for producing high-quality API documentation?
Product marketing team
Product Engineers
Technical writers who understand APIs
Correct answer.
Only the original API developers
Question 76
How does comprehensive API documentation contribute to improved security?
By speeding up pen testers' ability to attack your application
By decreasing room for error when a developer is connecting to an API
Incorrect.
By allowing developers to see the source code of the API
By defining consistent authentication and authorization practices
Question 77
How can you reduce the risk of server information leaks?
Remove or customize server response headers to hide sensitive details
Correct answer.
Enable verbose error messages
Allow directory listings to mask true server details
Display server version numbers for transparency
Question 78
Which of the following is NOT one of the four primary actors in the OAuth protocol?
Resource Owner
Authorization Server
Client
Encryption Server
Correct answer.
Question 79
Which risk category in the 2023 update is a combination of Excessive Data Exposure and Mass
Assignment?
Broken Function Level Authorization
Broken Object Property Level Authorization
Correct answer.
Broken Authentication
Unsafe Consumption of APIs
Question 80
How does an API facilitate communication between software applications?
By compiling code into machine-readable instructions
By storing and retrieving user credentials for authentication
By defining a set of rules and protocols for data exchange
Correct answer.
By converting frontend code into backend logic automatically
Question 81
Which of the following is an example of Security Misconfiguration according to the OWASP Top 10?
Using default configurations in a cloud environment, exposing sensitive data to unauthorized access
Allowing cross-origin resource sharing (CORS) without restrictions
Failing to use encryption for sensitive data storage
All of the above
Correct answer.
Question 82
In the Bumble example, which vulnerability allowed users to upgrade their account without proper
payment?
Broken Object Level Authorization
Broken Function Level Authorization
Correct answer.
Broken Authentication
Unrestricted Access to Sensitive Business Flows
Question 83
What is one major benefit of using an API gateway as mentioned in the course?
It centralizes API management and allows consistent policies
Correct answer.
It eliminates the need for API documentation
It removes the need for manual testing entirely
It automates the entire API development process
Question 84
What are claims within the context of OAuth tokens?
They provide detailed user identity information for fine-grained authorization
Correct answer.
They represent the token’s encryption algorithm
They are alternative names for scopes
They are metadata used only for logging purposes encryption in API communication
Question 85
Which is most commonly responsible for authentication breaches?
Unsecured endpoints
Correct answer.
Overly complex authentication
Lack of captcha
Lack of 2-factor authentication
Question 86
What is the purpose of the ‘kid’ (Key ID) or ‘x5t’ field in a JWT header?
To reference the key or certificate used to sign the token
Correct answer.
To define the token format (by value or by reference)
To list the token’s scopes
To indicate the expiration time of the token
Question 87
What is the primary purpose of the HTTP Only flag on a cookie?
To prevent JavaScript from reading the cookie data
Correct answer.
To improve cookie encryption on the client side
To increase the cookie’s storage size
To allow JavaScript access for dynamic content
Question 88
What is meant by a server information leak?
A header that advertises the server’s uptime
Any unintended exposure of details about the server’s configuration and technology stack
Correct answer.
A feature that displays server logs publicly
A vulnerability that exposes the server’s file system structure
Question 89
Why is a refresh token used in OAuth?
To allow the client to obtain new access tokens without re-prompting the user for credentials
Correct answer.
To provide the client with a token that never expires
To be sent to the resource server along with the access token
To encrypt the access token
Question 90
Which technical tip can help implement effective rate limiting?
Rely solely on disk-based SQL operations to track requests
Ignore client signatures when setting rate limits
Use in-memory solutions like caching to manage throttle counters
Correct answer.
Increase rate limits during peak hours to accommodate all users
Question 91
In the course, what does “API sprawl” refer to?
The growth of API documentation in multiple formats
The expansion of an API’s functionality over time
The existence of undocumented APIs leading to duplication
Correct answer.
The use of too many programming languages in one API
Question 92
In OAuth, what purpose do scopes serve?
They define the access privileges granted an application level
Correct answer.
They identify the resource server for the token
They specify the lifetime of a token
They determine which encryption method is used for the token
Question 93
Why is it generally discouraged for clients to decode and rely on the contents of access tokens (e.g.,
JWTs)?
Because decoding tokens is computationally prohibitive
Because the tokens are encrypted and cannot be read
Because access tokens do not contain any useful information
Because the token’s internal structure may change over time
Correct answer.
Question 94
How should developers use API documentation when integrating an API?
Rely on sample code from the documentation and modify it for your integration
Read through the endpoints, request formats, and authentication methods before starting
integration
Correct answer.
Only reference the documentation when encountering errors
Use the documentation only to check for error codes
Question 95
What is a path traversal vulnerability?
It encrypts sensitive data on the server
It allows unintended access to files and directories
Correct answer.
It allows attackers to modify server configurations
It enables injection of malicious scripts
Question 96
What is the purpose of having a “security style guide” as part of API documentation?
To provide syntax when replacing verbose error messages
To list how discovered vulnerabilities should be remedied
To standardize the visual design of the documentation pages
To enforce consistent security practices across the API
Correct answer.
Question 97
What is the primary focus of the “OWASP API Security Top 10 and Beyond” course?
Updates on API security vulnerabilities
Correct answer.
Fundamentals of network infrastructure security
Best practices for writing API documentation
How to design RESTful APIs from scratch
Question 98
What is the primary security risk associated with bearer tokens?
They are incompatible with JSON Web Tokens
They can only be used with mutual TLS
They require multiple headers for transmission
They can be used by anyone in possession of the token
Correct answer.
Question 99
Why is it important to document error responses in API documentation?
To stay accountable with government regulations and requirements
To help developers understand and handle failures
Correct answer.
To confuse non-technical stakeholders
To help pen testers have a better understanding of their attack progress
Question 100
Which specification format is commonly used to create machine- and human-readable API
documentation?
OpenAPI
Correct answer.
XML Schema
HTML5
JSON Web Tokens