D329 Networks and Security Applications - Set 5 - Part 2

Correct Answer: Ensuring only authorized clients can invoke the interface

APIs are directly reachable interfaces to application functionality, so they require authentication and authorization just as user interfaces do.

Correct Answer: Abuse, brute forcing, and resource exhaustion become possible

Without rate limits, attackers can brute force credentials, scrape data at scale, or exhaust backend resources, so throttling is a core API control.

Correct Answer: It identifies the caller but is easily leaked and does not prove user identity

API keys are static shared secrets frequently leaked in source code or logs, and they identify an application rather than authenticating an individual user.

Correct Answer: Delegated authorization allowing limited access without sharing credentials

OAuth 2.0 lets a user grant an application limited access to resources on their behalf without revealing their password to that application.

Correct Answer: A stolen token is only useful for a brief window

Short expiry limits the exposure window if a token is compromised, with refresh tokens providing continuity without extending the access token's validity.

Correct Answer: Confirming the server's identity before establishing an encrypted session

The browser verifies the certificate is valid, unexpired, matches the hostname, and chains to a trusted authority, preventing connection to an impostor server.

Correct Answer: The certificate could not be validated and the connection may be intercepted

A certificate warning means validation failed, which may indicate misconfiguration or an active interception attempt. Users should not proceed on sensitive sites.

Correct Answer: A policy instructing browsers to connect only over HTTPS

HSTS tells browsers to use HTTPS exclusively for a domain, preventing downgrade attacks and accidental plaintext connections.

Correct Answer: Forging the sender address to make a message appear to come from someone else

SMTP does not inherently authenticate senders, so attackers can forge the From address, which underpins most phishing and business email compromise.

Correct Answer: Email spoofing by validating sender authorization and message integrity

SPF authorizes sending servers, DKIM cryptographically signs messages, and DMARC defines policy and reporting, together making domain spoofing far harder.

Correct Answer: Fraud using impersonated or compromised email to induce payments or data disclosure

BEC impersonates executives or vendors to trick employees into transferring funds or sensitive data, often without any malware involved.

Correct Answer: Out-of-band verification of payment changes using known contact details

Verifying payment instruction changes through an independently known phone number defeats the impersonation, since the attacker does not control that channel.

Correct Answer: Software monitoring endpoint activity to detect and respond to threats

EDR continuously monitors endpoint behavior, detecting suspicious activity that signature-based antivirus misses and enabling investigation and containment.

Correct Answer: It identifies suspicious activity patterns rather than matching known malware signatures

Signature detection matches known malware, missing novel threats. Behavioral detection flags anomalous activity, catching previously unseen attacks.

Correct Answer: Permitting only explicitly approved programs to execute

Allow-listing permits only approved applications to run, which blocks unknown malware by default rather than trying to enumerate every malicious program.

Correct Answer: Unknown and novel threats are blocked by default

Deny-listing can only block known bad items, while allow-listing blocks everything not explicitly approved, including previously unseen malware.

Correct Answer: Enforcing security policy and configuration on mobile endpoints

MDM enforces policies such as encryption, passcode requirements, and remote wipe on mobile devices accessing organizational data.

Correct Answer: Organizational data resides on devices the organization does not fully control

Personally owned devices may be unpatched, shared, or lost, yet hold corporate data, so containerization and policy enforcement are required.

Correct Answer: Erasing organizational data from a lost or stolen device

Remote wipe removes corporate data from a device that is lost, stolen, or belongs to a departing employee, limiting exposure of that data.

Correct Answer: Physical access often defeats logical controls entirely

An attacker with physical access can boot alternative media, extract drives, or install hardware implants, bypassing many logical protections.