CF-WORKERS-APISEC Practice Test

CF-WORKERS-APISEC practice test: what's covered

• Routes, bindings, secrets, API Shield, observability, rollback

Free CF-WORKERS-APISEC sample questions

1. A team deploys a Worker for `/api/*`, but unauthenticated requests to `/api/admin/export` still reach a legacy origin before the Worker validates identity. Which deployment check should block release?

   • A. Verify the Worker route or run-worker-first path receives the request before any origin fallback
   • B. Confirm the static asset directory contains an updated manifest file
   • C. Increase the Worker memory budget so authentication finishes faster
   • D. Add a dashboard bookmark for the legacy origin export page
   Show answer

   Correct: A. The release gate is proving the security control is in the actual traffic path. If the request can bypass the Worker and hit a legacy origin first, identity, authorization, logging, and rate limiting in the Worker are not protecting the endpoint. Static metadata or performance tuning does not fix route ownership.

2. During review, a Worker keeps an upstream API token in a plain text environment variable because the value is convenient to inspect in the dashboard. What should the reviewer require?

   • A. Move the token to a Worker secret and keep non-sensitive feature flags as variables
   • B. Leave the token visible because Workers encrypt all string variables automatically
   • C. Copy the token into client JavaScript so browser errors become easier to debug
   • D. Rename the variable with a PRIVATE prefix and keep the same storage behavior
   Show answer

   Correct: A. Cloudflare treats secrets as values passed to the Worker like environment variables, but the secret value is not visible after definition. Plain text variables are useful for configuration, not passwords or API tokens. Renaming a visible variable or exposing it to client code does not reduce leakage risk.

3. An API has high-volume authenticated clients and a documented OpenAPI schema. Which Cloudflare controls best align with OWASP API risks around abuse, unexpected payloads, and client identity?

   • A. Per-endpoint rate limiting based on observed traffic patterns
   • B. Schema validation for documented request shapes
   • C. Mutual TLS or JWT validation for strong client authentication where appropriate
   • D. A longer browser cache TTL for all JSON responses
   • E. A marketing landing page describing the API roadmap
   Show answer

   Correct: A and B and C. Rate limiting addresses automated abuse, schema validation catches unexpected request shapes, and mTLS or JWT validation strengthens client identity. Cache TTLs and roadmap pages may help performance or communication, but they are not direct controls for broken authentication, unrestricted resource consumption, or schema drift.

4. A learner can change `/api/users/123/report` to `/api/users/124/report` and receive another tenant's report. The Worker already validates a session cookie. What is the missing control?

   • A. Object-level authorization that checks the requested resource belongs to the authenticated principal
   • B. A stronger Content-Security-Policy header on the exam results page
   • C. A larger KV namespace so user reports are spread across more keys
   • D. A retry loop around the downstream report generation request
   Show answer

   Correct: A. A valid session only proves who the caller is. The Worker must also verify that this user can access the specific object or tenant resource requested. This is the OWASP API broken object level authorization pattern; response headers, storage size, or retry logic do not enforce ownership.

5. A Worker returns `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Credentials: true` for a student progress API. What is the safer production approach?

   • A. Allow only explicit trusted origins and keep credentialed cross-origin flows narrow and logged
   • B. Keep wildcard origins because Cloudflare automatically blocks credential theft
   • C. Remove authentication so credentialed CORS no longer applies to the endpoint
   • D. Move the endpoint path under `/public` so browsers treat it as static content
   Show answer

   Correct: A. Credentialed browser APIs need explicit origin decisions and clear logging. A wildcard origin is not a safe default for session-backed data, and removing authentication or changing the path simply moves the exposure. CORS should match the intended browser trust boundary, not hide an access-control issue.

Last updated: 2026-10-19

CF-WORKERS-APISEC practice test FAQ