As part of an IoT project, an organization is developing an application that will share multiple clients using a REST API. Based on the software development process, what are two valid technical…

Question

Options

• ARespond to request failures in detail to allow users for easier troubleshooting.
• BImplement HTTP whitelisting to only methods that are allowed.
• CImplement and review audit logs for security-related events.
• DReject HTTP methods that are invalid with an error code 404.
• EImplement physical firewalling and access control to the resources.

• A
  3% (1)
• B
  76% (25)
• C
  12% (4)
• E
  9% (3)

Explanation

Options B and D represent direct, development-phase techniques applied at the API layer itself. Whitelisting only permitted HTTP methods (B) reduces the attack surface by blocking methods like DELETE or PUT if they're not needed, preventing method-based exploits. Responding with a 404 (rather than 405) for invalid methods (D) is a deliberate security technique that obscures whether a resource exists, preventing attackers from fingerprinting the API structure.

Why the distractors fail:

• A is actively harmful - detailed error responses leak implementation details (stack traces, DB schemas) that attackers exploit; errors should be generic in production.
• C is a valid security practice but belongs to the operational phase, not the software development phase; reviewing logs presupposes a deployed, running system.
• E describes infrastructure-level controls (physical firewalls), not REST API development activities - the question specifically asks about securing the API during development.

Memory tip: Think of B and D as gatekeeping at the door - B decides who's on the guest list (whitelist valid methods), and D gives nothing away to uninvited guests (return 404, not 405, to avoid revealing the room even exists). If a choice is about operations or infrastructure rather than the API code itself, it's out of scope for this question.

No community discussion yet for this question.