nerdexam
Isaca

CISA · Question #273

To mitigate the risk of exposing data through application programming interface (API) queries, which of the following design considerations is MOST important?

The correct answer is C. Data minimization. To mitigate data exposure risk via API queries, data minimization is the most crucial design consideration, ensuring only necessary data is returned.

Submitted by dimitri_ru· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

To mitigate the risk of exposing data through application programming interface (API) queries, which of the following design considerations is MOST important?

Options

  • AData quality
  • BData integrity
  • CData minimization
  • DData retention

How the community answered

(26 responses)
  • A
    4% (1)
  • B
    12% (3)
  • C
    81% (21)
  • D
    4% (1)

Why each option

To mitigate data exposure risk via API queries, data minimization is the most crucial design consideration, ensuring only necessary data is returned.

AData quality

Data quality focuses on the accuracy and consistency of data, which is important but does not directly prevent excessive data exposure in API responses.

BData integrity

Data integrity ensures that data remains accurate and consistent over its lifecycle, but it does not inherently limit the amount of data returned by an API query.

CData minimizationCorrect

Data minimization is most important because it ensures that API responses only include the absolute minimum amount of data required for the specific request, significantly reducing the potential attack surface and the quantity of sensitive information exposed if an API is compromised or misused.

DData retention

Data retention policies govern how long data is stored, which is crucial for overall data governance but doesn't directly address the risk of over-exposure through real-time API queries.

Concept tested: API security design principles (data minimization)

Source: https://learn.microsoft.com/en-us/azure/architecture/guide/security/data-minimization

Topics

#API Security#Data Minimization#Secure Design Principles#Risk Mitigation

Community Discussion

No community discussion yet for this question.

Full CISA Practice