API and Webhook Hacking CEH Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   An attacker sends the following payload to an API endpoint: `username=admin' OR '1'='1`. Which type of attack is being attempted?

   • ASQL injection
   • BMass assignment
   • CCross-site scripting (XSS)
   • DCommand injection
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a common technique used to bypass API rate limiting?

   • ASending requests with a lower HTTP version
   • BAdding extra HTTP headers
   • CUsing HTTPS instead of HTTP
   • DRotating IP addresses or using proxy networks
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A payment gateway sends webhook notifications to a merchant's endpoint to update order status. A security tester finds that the endpoint accepts any POST request and processes the payload without verifying a signature. Which of the following is the most effective control to prevent an attacker from sending fake 'payment_succeeded' events?

   • ALog all incoming webhook requests for later review.
   • BCheck that the 'User-Agent' header matches the payment gateway's expected value.
   • CRequire the webhook to be sent from the gateway's IP address.
   • DVerify a cryptographic signature (e.g., HMAC-SHA256) in the webhook payload using a shared secret known only to the merchant and the payment gateway.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SaaS company receives webhooks from multiple clients. Each webhook triggers a series of database updates and external API calls. An attacker floods the webhook endpoint with thousands of requests per second, causing the backend to become unresponsive. Which of the following is the most effective mitigation?

   • ADisable webhook logging to reduce I/O overhead.
   • BIncrease the timeout for webhook processing to 60 seconds.
   • CImplement rate limiting and queue incoming webhooks for asynchronous processing.
   • DRequire clients to send webhooks only during business hours.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company exposes an internal API for employee management. A security review reveals that the API responds to OPTIONS requests with a list of allowed methods including DELETE, and that error messages include full stack traces. Which of the following is the most appropriate action to harden the API?

   • ADisable unnecessary HTTP methods (e.g., DELETE) and configure generic error messages that do not expose stack traces.
   • BMove the API to a different port.
   • CImplement authentication on the OPTIONS method.
   • DAdd a rate limit to the OPTIONS method.
   Reveal Solution Discussion Select an answer first