An IS auditor discovers that a developer has used the same key to grant access to multiple applications making calls to an application programming interface (API). Which of the following is the BEST recommendation to address this situation?

Question

Alysson Rodrigo Freires Neto · Accepted Answer

Replace the API key with time-limited tokens that grant least privilege access.

Alysson Rodrigo Freires Neto · Answer

Authorize the API key to allow read-only access by all applications.

Alysson Rodrigo Freires Neto · Answer

Implement a process to expire the API key after a previously agreed-upon period of time.

Alysson Rodrigo Freires Neto · Answer

Coordinate an API key rotation exercise with all impacted application owners.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 881 - CISA discussion

Suggested answer: A

0 comments