Module 10 Knowledge Check
5 questions. Pass mark 4 out of 5. Answer every question before checking the answer key below, then retry after reading the feedback.
1. A valid API key proves…
- A. the caller's identity
- B. that the caller holds a valid key
- C. the request came from your frontend
- D. the key has not leaked
2. A credential in a query string is recorded by…
- A. your logs only
- B. at least six systems you do not control
- C. nothing, if HTTPS is used
- D. the browser only
3. 401 and 403 differ in that…
- A. they are interchangeable
- B. 401 means authenticate, 403 means you specifically may not
- C. 403 is for missing keys
- D. 401 is for expired tokens only
4. CORS protects against…
- A. all cross-origin requests
- B. a browser page on another origin reading your response
- C. scripted clients
- D. API key theft
5. An in-memory rate limiter with four workers…
- A. works correctly
- B. allows four times the intended limit
- C. is shared automatically
- D. fails closed
---
Answer Key and Explanations
Check these only after attempting every question.
1. B - that the caller holds a valid key
Keys are shared, copied and committed by accident.
2. B - at least six systems you do not control
Access logs, proxy logs, CDN logs, browser history, Referer headers and screenshots.
3. B - 401 means authenticate, 403 means you specifically may not
403 tells a client not to bother retrying with the same credential.
4. B - a browser page on another origin reading your response
curl, a server and a mobile app ignore it entirely.
5. B - allows four times the intended limit
And a restart forgets everything. Rate limiting needs shared state.
Practical Check
Apply this module to your own work: complete the module activity for *Security Boundaries: API Keys, Auth Concepts and CORS*, then write one sentence naming what your result shows and one naming what it does not.
Strong Answer Pattern
A strong answer names the task, the evidence used, the check performed, and the remaining limitation. It avoids "proved", "guaranteed", or "always" unless the evidence genuinely supports it.