API and Webhook Hacking CEH Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company exposes a public API for checking order status. The API uses API keys for authentication and has a rate limit of 100 requests per minute per key. An attacker creates multiple free accounts to obtain multiple API keys and uses them to rotate through the keys, bypassing the per-key rate limit and overwhelming the backend. Which mitigation would be most effective?

   • AImplement a global rate limit per IP address in addition to per-key limits
   • BRequire a valid email address for account creation
   • CUse a CAPTCHA on the API endpoint
   • DIncrease the per-key rate limit to 1000 requests per minute
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company exposes a public API endpoint that triggers a webhook to a third-party service. An attacker sends thousands of requests per second to the endpoint, causing the webhook to flood the third-party service and exhaust its resources. Which two controls should the company implement to mitigate this attack?

   • ADisable unnecessary HTTP methods and enable verbose error messages
   • BAdd signature verification to the webhook and use a longer secret key
   • CUse a private endpoint for the API and restrict access to known IP addresses
   • DImplement rate limiting on the API endpoint and add a queue or deduplication mechanism for webhook deliveries
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which API injection attack involves inserting malicious code into a query that is executed by a non-relational database, such as MongoDB?

   • ASQL injection
   • BLDAP injection
   • CCommand injection
   • DNoSQL injection
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an example of an API security misconfiguration?

   • AValidating input data
   • BImplementing rate limiting
   • CUsing HTTPS to encrypt traffic
   • DEnabling unnecessary HTTP methods like DELETE on a public endpoint
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company exposes a public API that triggers webhooks to a third-party service. The API has a rate limit of 10 requests per second per IP address. An attacker uses a botnet to send requests from thousands of different IP addresses, each staying below the rate limit, but collectively overwhelming the webhook receiver. Which mitigation would be most effective?

   • AIncrease the per-IP rate limit to 100 requests per second
   • BBlock all requests from cloud provider IP ranges
   • CUse a CAPTCHA on the API endpoint
   • DImplement a rate limit based on the authenticated user or API key rather than IP address
   Reveal Solution Discussion Select an answer first