Practice answering API Security Engineering interview questions in professional English. 5 exercises on OAuth 2.0, JWT validation, rate limiting, OWASP API Top 10, and mTLS.
What separates good from great API security answers
Name the attack vector: "BOLA allows access to other users' objects" beats "it's an auth issue"
Explain the mechanism: why does JWT alg:none work? what does it bypass?
Defence in depth: one control is never enough — layer them
OWASP API Top 10: know it by number — API1 through API10
0 / 15 completed
1 / 15
The interviewer asks: "What is the difference between OAuth 2.0 and OpenID Connect, and when would you use each?" Which answer is the most precise?
Option C is the strongest: defines OAuth 2.0's purpose precisely (delegated API access, resource owner authorisation), explains what OIDC adds (ID token as JWT with specific claims, UserInfo endpoint), gives a concrete use case for each, and most importantly warns against the common mistake of using access tokens for identity — explaining exactly why (access tokens are opaque, format not standardised). Option A is correct but has no mechanism or common pitfall. Option B is factually wrong — OIDC is not a new version of OAuth. Option D is superficially correct but adds SAML tangentially without adding insight about the OAuth/OIDC distinction.
2 / 15
The interviewer asks: "What is BOLA and how do you prevent it in an API?" Choose the most complete answer.
Option B is the strongest: names the OWASP ranking (API1), explains the exact mechanism (authentication is checked but object-level authorisation is skipped), specifies where the ID can appear (path parameter, query string, body), gives the precise prevention rule (compare authenticated principal ID with resource owner_id), adds the non-obvious architectural point (service layer check vs database query and ORM bypass risk), and describes automated testing to prevent regressions. Option A is minimal. Option C is accurate but offers no mechanism. Option D mentions UUIDs — which reduce guessability but do not prevent BOLA if authorisation is not checked — making it a common misconception that the strongest answer avoids.
3 / 15
The interviewer asks: "What JWT vulnerabilities should every API developer know about?" Which answer is the most comprehensive?
Option A is the strongest: names three specific, mechanistically distinct attacks (algorithm confusion with the public-key-as-HMAC-secret exploit explained precisely, alg:none bypassing signature verification, weak secret offline brute-force), gives a concrete mitigation for each, and adds an architectural recommendation (asymmetric algorithms for multi-service). Option B mentions weak secrets and expiry — important but only one of the three attack classes. Option C is best-practice advice without any attack mechanism. Option D mentions replay attacks (a real concern) but does not explain the algorithm attacks that are the most common JWT interview topic. Knowing the mechanism of each attack is what separates a security engineer from a developer who has read a checklist.
4 / 15
The interviewer asks: "How do you design rate limiting for a public API?" Choose the answer that shows the most architectural depth.
Option B is the strongest: structures the answer around four explicit design decisions (limit unit, algorithm, enforcement point, response format), explains the trade-offs of each algorithm (token bucket vs sliding window vs fixed window and their respective weaknesses), distinguishes unauthenticated from authenticated rate limiting with the reason (IP limiting is ineffective against distributed clients), and adds the operational requirement (Redis-backed, configurable without redeployment for incident response). Option A is the minimal answer. Option C correctly describes token bucket with Redis but only covers the algorithm decision — not unit selection, enforcement point, or response design. Option D names real tools but treats rate limiting as a configuration task rather than a design problem.
5 / 15
The interviewer asks: "What is mTLS and when would you require it for API security?" Which answer shows the most practical understanding?
Option C is the strongest: defines mTLS precisely (client certificate in TLS handshake, validated against CA or pinned identity), contrasts it with bearer tokens and explains why it is stronger (cryptographic vs possession-based), gives two specific use cases with justification (zero-trust service mesh, high-privilege APIs), names the operational challenge precisely (certificate lifecycle and rotation failure as outage), and gives a concrete operational solution (Istio or Vault, 24-hour TTL short-lived certificates). Option A is correct but superficial. Option B makes the factually wrong claim that most APIs use API keys instead — mTLS and API keys are not mutually exclusive, and many service meshes use mTLS by default. Option D mentions the right use case (internal microservices) and notes the PKI requirement but has no depth on why or how.
6 / 15
During a code review of a new API endpoint for user profile updates, Sarah (the reviewer) notices the following comment from David (the developer): 'Just using standard POST with JSON. No input validation or rate limiting. Seems simple enough.'
Which statement best reflects Sarah's concern regarding this approach?Option A
Sarah's concern stems from the lack of critical security measures. Simply using a standard POST request without authorization or input validation creates significant vulnerabilities. The developer's comment downplays the importance of protection against injection attacks and data corruption – these are fundamental requirements for any API endpoint handling user-supplied data. Option A is incorrect because authorization is a broader concern than just this specific endpoint.
7 / 15
You're investigating a Slack channel used by the API security team. A message from Alex (a junior engineer) reads: 'Just deployed the new API key rotation script. It uses `aws s3 cp` to move the keys, no error handling!'.
What is the primary risk highlighted in this message?Option A
Alex's message reveals a critical vulnerability: using `aws s3 cp` for key rotation without proper error handling. This method transmits sensitive API keys in plain text across the network, making them susceptible to interception and compromise. While logging is important, the immediate risk here is the insecure transfer of credentials. Options B, C, and D are secondary concerns that don't represent the core issue.
8 / 15
An API response from a service is being analyzed. The response contains a JSON Web Token (JWT) with a signature that appears to be valid. However, upon closer inspection of the JWT's header, you discover it's missing the `alg` parameter.
What potential security implication does this represent?Option A
The absence of the `alg` parameter in a JWT header fundamentally weakens its security. The `alg` parameter specifies the cryptographic algorithm used to sign the token – without it, an attacker can forge a valid-looking signature. This allows them to impersonate legitimate users or applications. Options B and C are incorrect because the lack of an algorithm *does* expose the system to forgery attacks. Option D is simply false.
9 / 15
A team lead, Mark, asks you to design rate limiting for a public API that provides weather data. He wants a solution that can handle peaks in demand but doesn't overly complicate the system.
Which architectural approach would best balance scalability and simplicity?Option A
The token bucket algorithm provides a good balance between simplicity and effectiveness for rate limiting. It's relatively easy to implement and configure, allowing the API to handle bursts of traffic while still enforcing usage limits. Redis-based stateful rate limiting is more complex and prone to issues with scaling. Option D doesn't address rate limiting directly. Delegating to a cloud provider might limit customization.
10 / 15
During a discussion about securing an API with a backend service, Emily (a senior engineer) explains: 'We need to ensure that our application can *authenticate* the requests coming from our mobile app before processing them. mTLS is the only way to guarantee this.'
What does Emily primarily mean by 'authenticate' in this context?Option A
Emily is referring to authentication – the process of verifying the identity of a client (in this case, the mobile app) before granting access to the API. While mTLS *does* contribute to secure connections, it's specifically about providing proof that the client is who they claim to be by using certificates. Options B, C, and D describe other security mechanisms – authorization, encryption, and data validation respectively.
11 / 15
During a code review of a new API endpoint for user profile updates, Sarah (the reviewer) notices the following comment from David (the developer): 'Just using standard POST with JSON. No input validation or rate limiting. Seems simple enough.'
Which statement best reflects Sarah's concern regarding this approach?Option A
Sarah's concern stems from the lack of critical security measures. Simply using a standard POST request without authorization or input validation creates significant vulnerabilities. The developer's comment downplays the importance of protection against injection attacks and data corruption – these are fundamental requirements for any API endpoint handling user-supplied data. Option A is incorrect because authorization is a broader concern than just this specific endpoint.
12 / 15
You're investigating a Slack channel used by the API security team. A message from Alex (a junior engineer) reads: 'Just deployed the new API key rotation script. It uses `aws s3 cp` to move the keys, no error handling!'.
What is the primary risk highlighted in this message?Option A
Alex's message reveals a critical vulnerability: using `aws s3 cp` for key rotation without proper error handling. This method transmits sensitive API keys in plain text across the network, making them susceptible to interception and compromise. While logging is important, the immediate risk here is the insecure transfer of credentials. Options B, C, and D are secondary concerns that don't represent the core issue.
13 / 15
An API response from a service is being analyzed. The response contains a JSON Web Token (JWT) with a signature that appears to be valid. However, upon closer inspection of the JWT's header, you discover it's missing the `alg` parameter.
What potential security implication does this represent?Option A
The absence of the `alg` parameter in a JWT header fundamentally weakens its security. The `alg` parameter specifies the cryptographic algorithm used to sign the token – without it, an attacker can forge a valid-looking signature. This allows them to impersonate legitimate users or applications. Options B and C are incorrect because the lack of an algorithm *does* expose the system to forgery attacks. Option D is simply false.
14 / 15
A team lead, Mark, asks you to design rate limiting for a public API that provides weather data. He wants a solution that can handle peaks in demand but doesn't overly complicate the system.
Which architectural approach would best balance scalability and simplicity?Option A
The token bucket algorithm provides a good balance between simplicity and effectiveness for rate limiting. It's relatively easy to implement and configure, allowing the API to handle bursts of traffic while still enforcing usage limits. Redis-based stateful rate limiting is more complex and prone to issues with scaling. Option D doesn't address rate limiting directly. Delegating to a cloud provider might limit customization.
15 / 15
During a discussion about securing an API with a backend service, Emily (a senior engineer) explains: 'We need to ensure that our application can *authenticate* the requests coming from our mobile app before processing them. mTLS is the only way to guarantee this.'
What does Emily primarily mean by 'authenticate' in this context?Option A
Emily is referring to authentication – the process of verifying the identity of a client (in this case, the mobile app) before granting access to the API. While mTLS *does* contribute to secure connections, it's specifically about providing proof that the client is who they claim to be by using certificates. Options B, C, and D describe other security mechanisms – authorization, encryption, and data validation respectively.
What does "API Security Engineer Interview Questions — Best-Answer Practice" cover?
Practice answering API Security Engineering interview questions in professional English. 5 exercises on OAuth 2.0, JWT validation, rate limiting, OWASP API Top 10, and mTLS.
How many questions are in this interview set?
This set has 15 exercises, each with a full explanation.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do these exercises include model answers?
Yes. Each interview question gives you several possible responses and asks you to pick the one that communicates most clearly and completely — the explanation then breaks down exactly why that answer works, including the specific vocabulary a strong candidate would use.
What if I choose an answer that isn't the strongest one?
You'll see which option was correct and read a full explanation of why it's stronger than the alternatives, plus the key vocabulary and phrasing worth reusing in a real interview.
Can I retry the questions?
Yes — use the "Try again" button on the results screen to reset and go through the set again.
Is this the same as a real technical or behavioural interview?
No — it's focused practice for the language side of interviewing: recognising which phrasing sounds precise and confident versus vague, and knowing the vocabulary interviewers expect for this role. It won't replace mock interviews, but it builds the vocabulary you'll need in one.
Where can I find interview prep for other roles?
Browse the full Interview exercises hub for 170+ modules covering behavioural, technical, and system design rounds across dozens of IT roles, or check the "Next up" link below to continue.
Do I need an account, and is my progress saved?
No account is needed. Progress is tracked only for your current visit — reloading or leaving the page resets the counter.
Who writes these interview questions?
Every question is written by the CoderSlingo team based on real technical interview patterns for this role, then reviewed for accuracy and clarity.