D413 ITEC 3201 Telecomm & Wireless
Communications
Final Assessment Review
(Questions & Solutions)
2025
©2025
, 1. Case Study – Secure API Integration
A cloud service provider exposes its services via RESTful APIs. During a
security assessment, the team notices that some endpoints are
vulnerable to unauthorized access and injection attacks.
Question: Which combination of security measures is best suited to
protect these APIs?
A. Rely exclusively on IP whitelisting and static API keys
B. Implement HTTPS, OAuth2-based authorization, and input sanitization
C. Use only HTTPS encryption without any additional authentication
D. Replace RESTful APIs with SOAP exclusively
ANS: B. Implement HTTPS, OAuth2-based authorization, and input
sanitization
Rationale: HTTPS ensures encrypted transmission, OAuth2 provides a
robust framework for authentication and authorization, and proper input
sanitization mitigates injection vulnerabilities—together forming a
comprehensive API security strategy.
---
2. Case Study – Web Application Firewall (WAF) Configuration
A financial application that processes online transactions is experiencing
frequent attempts at SQL injection and cross‑site scripting (XSS) attacks.
Question: Which solution will best defend against these application-
layer threats?
A. Deploy a Web Application Firewall (WAF) with customized rule sets
B. Rely solely on secure coding practices without additional network
defenses
C. Disable client-side scripting altogether
D. Increase the server’s CPU resources
ANS: A. Deploy a Web Application Firewall (WAF) with customized
rule sets
Rationale: A WAF inspects incoming HTTP/HTTPS traffic and blocks
malicious requests by applying predefined rules, thereby preventing
©2025
, common injection and XSS attacks.
---
3. Case Study – TLS Certificate Management
An e-commerce website requires robust encryption for customer data.
The security team is responsible for managing TLS certificates for secure
HTTPS access.
Question: Which of the following practices is critical in TLS certificate
management?
A. Using self-signed certificates exclusively for all customers
B. Regularly renewing certificates and monitoring for revocations
C. Disabling certificate transparency logs
D. Sharing private keys among multiple servers
ANS: B. Regularly renewing certificates and monitoring for
revocations
Rationale: Timely renewal and revocation checking of certificates are
key to maintaining trust and ensuring that expired or compromised
certificates do not jeopardize secure communications.
---
4. Case Study – Data Encryption at Rest
A business storing sensitive client records in a cloud-based database
needs to ensure that data is protected if unauthorized access occurs.
Question: Which approach is most appropriate for protecting data at
rest?
A. Relying solely on physical security measures
B. Implementing full-disk encryption and using application-level
encryption
C. Storing data unencrypted but limiting access to trusted users
D. Using obfuscation techniques only
ANS: B. Implementing full-disk encryption and using application-level
encryption
Rationale: Encrypting data at both the disk and application levels
©2025
Communications
Final Assessment Review
(Questions & Solutions)
2025
©2025
, 1. Case Study – Secure API Integration
A cloud service provider exposes its services via RESTful APIs. During a
security assessment, the team notices that some endpoints are
vulnerable to unauthorized access and injection attacks.
Question: Which combination of security measures is best suited to
protect these APIs?
A. Rely exclusively on IP whitelisting and static API keys
B. Implement HTTPS, OAuth2-based authorization, and input sanitization
C. Use only HTTPS encryption without any additional authentication
D. Replace RESTful APIs with SOAP exclusively
ANS: B. Implement HTTPS, OAuth2-based authorization, and input
sanitization
Rationale: HTTPS ensures encrypted transmission, OAuth2 provides a
robust framework for authentication and authorization, and proper input
sanitization mitigates injection vulnerabilities—together forming a
comprehensive API security strategy.
---
2. Case Study – Web Application Firewall (WAF) Configuration
A financial application that processes online transactions is experiencing
frequent attempts at SQL injection and cross‑site scripting (XSS) attacks.
Question: Which solution will best defend against these application-
layer threats?
A. Deploy a Web Application Firewall (WAF) with customized rule sets
B. Rely solely on secure coding practices without additional network
defenses
C. Disable client-side scripting altogether
D. Increase the server’s CPU resources
ANS: A. Deploy a Web Application Firewall (WAF) with customized
rule sets
Rationale: A WAF inspects incoming HTTP/HTTPS traffic and blocks
malicious requests by applying predefined rules, thereby preventing
©2025
, common injection and XSS attacks.
---
3. Case Study – TLS Certificate Management
An e-commerce website requires robust encryption for customer data.
The security team is responsible for managing TLS certificates for secure
HTTPS access.
Question: Which of the following practices is critical in TLS certificate
management?
A. Using self-signed certificates exclusively for all customers
B. Regularly renewing certificates and monitoring for revocations
C. Disabling certificate transparency logs
D. Sharing private keys among multiple servers
ANS: B. Regularly renewing certificates and monitoring for
revocations
Rationale: Timely renewal and revocation checking of certificates are
key to maintaining trust and ensuring that expired or compromised
certificates do not jeopardize secure communications.
---
4. Case Study – Data Encryption at Rest
A business storing sensitive client records in a cloud-based database
needs to ensure that data is protected if unauthorized access occurs.
Question: Which approach is most appropriate for protecting data at
rest?
A. Relying solely on physical security measures
B. Implementing full-disk encryption and using application-level
encryption
C. Storing data unencrypted but limiting access to trusted users
D. Using obfuscation techniques only
ANS: B. Implementing full-disk encryption and using application-level
encryption
Rationale: Encrypting data at both the disk and application levels
©2025
