API and Webhook Hacking CEH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of signing webhook payloads with a secret?

   • ATo authenticate the receiver to the sender
   • BTo encrypt the payload so only the receiver can read it
   • CTo verify the authenticity and integrity of the webhook request
   • DTo compress the payload for faster delivery
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer is building a webhook endpoint that receives order updates from a partner. The partner sends a secret key in the header 'X-Webhook-Secret'. The developer wants to ensure that only the partner can trigger the webhook and that the payload has not been tampered with. Which implementation is most secure?

   • AVerify that the request comes from the partner's IP address
   • BCheck that the 'X-Webhook-Secret' header matches the shared secret
   • CVerify a signature computed with HMAC-SHA256 over the raw request body using a shared secret
   • DUse a timestamp in the payload and reject requests older than 5 minutes
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An attacker captures a valid webhook request and resends it later to trigger the same event again. Which type of attack is this?

   • AReplay attack
   • BMan-in-the-middle attack
   • CDenial-of-service attack
   • DInjection attack
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A webhook receiver processes a payload that contains a field `event_type`. An attacker changes `event_type` from `user.created` to `admin.created`. What is the potential impact?

   • AThe receiver will ignore the webhook
   • BThe payload will be automatically encrypted
   • CThe receiver may execute a different, possibly more privileged action
   • DThe webhook will be rejected due to invalid JSON
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services company exposes a public API for balance inquiries. During a load test, the API becomes unresponsive when a single client sends 1,000 requests per second. The API is behind an API gateway that currently has no rate limiting configured. Which of the following is the most effective first step to mitigate this resource exhaustion risk?

   • ARequire clients to use mutual TLS authentication.
   • BConfigure rate limiting on the API gateway to allow a maximum of 100 requests per second per API key, with a burst limit of 200.
   • CIncrease the number of backend instances to handle 2,000 requests per second.
   • DAdd a CAPTCHA to the API endpoint.
   Reveal Solution Discussion Select an answer first