API and Webhook Hacking CEH Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is reviewing an API that uses a NoSQL database. The API accepts a JSON filter object and passes it directly to a database query. The team wants to prevent NoSQL injection while maintaining the flexibility of the filter feature. Which approach is most effective?

   • AUse a blacklist of common operators like '$ne' and '$gt'
   • BConvert the filter object to a string and escape special characters
   • CValidate the filter object against a schema that allows only specific fields and data types, and reject any operator keys
   • DDisable the filter feature entirely and use fixed queries
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's webhook receiver is frequently overwhelmed by bursts of legitimate traffic from a partner during peak hours, causing timeouts and lost events. The company also suspects that an attacker is sending forged webhook requests to amplify the load. The company wants to ensure reliable processing of legitimate events while mitigating the impact of malicious traffic. Which combination of controls is most effective?

   • AImplement signature verification, a message queue with a dead-letter queue, and autoscaling based on queue depth
   • BUse a fixed number of worker instances and reject requests that exceed a certain rate
   • CIncrease the server timeout and disable signature verification to reduce processing overhead
   • DStore all events in a database and process them synchronously
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A developer at a healthcare startup exposes a REST API for patient records. The API uses JWT-based authentication. A penetration tester finds that by changing the 'id' parameter in a GET request to /api/v1/patients/{id}, they can retrieve another patient's record without any additional checks. The JWT contains the user's role and user ID. Which of the following is the most effective fix for this vulnerability?

   • AAdd a rate limit of 10 requests per minute per user.
   • BAdd a check in the API handler that verifies the 'id' parameter matches the user ID from the JWT unless the user has an admin role.
   • CRemove the 'id' parameter from the URL and require it in the request body.
   • DUse a random UUID for patient IDs instead of sequential integers.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An e-commerce platform accepts product search queries via a REST API endpoint. The API constructs a MongoDB query using user input directly. A security consultant discovers that sending a payload like '{"$ne": null}' in the search field returns all products, bypassing the intended filter. Which of the following is the most effective mitigation?

   • AAdd a web application firewall (WAF) rule to block requests containing '$ne'.
   • BUse parameterized queries or an Object Document Mapper (ODM) that sanitizes input and disallows operator keys.
   • CValidate that the search field contains only alphanumeric characters and spaces.
   • DLimit the number of results returned to 100 per request.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multi-tenant SaaS application uses a single API endpoint to update user profiles. The endpoint accepts a JSON body and binds all fields to the user object. A tenant admin discovers they can set 'account_tier' to 'enterprise' by adding that field to the request. The company wants to fix this without breaking the existing API contract for legitimate clients. Which of the following is the best approach?

   • AIntroduce a separate endpoint for admin-only fields and remove 'account_tier' from the public profile update endpoint's binding whitelist.
   • BUse a blacklist of sensitive fields (e.g., 'account_tier', 'is_admin') to exclude them from binding.
   • CAdd a check in the endpoint that verifies the user's role before allowing any update.
   • DChange the API to require a separate 'confirm' parameter for any field that is not in the original request.
   Reveal Solution Discussion Select an answer first