API and Webhook Hacking CEH Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which type of API vulnerability occurs when an application uses a user-supplied identifier (such as an ID in a URL) to directly access an object without verifying that the user is authorized to access that specific object?

   • ABroken object-level authorization (BOLA)
   • BSecurity misconfiguration
   • CBroken function-level authorization
   • DMass assignment
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   How can an attacker manipulate a webhook payload to inject malicious data?

   • ABy altering the payload content before it reaches the receiver, if the signature is not verified
   • BBy using a different HTTP method
   • CBy adding extra headers to the request
   • DBy sending the payload over HTTPS
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security consultant is reviewing a webhook receiver that processes payment notifications. The receiver is behind a load balancer that terminates TLS. The application logs the full request body for debugging. The consultant notices that the logs contain credit card numbers and that the webhook endpoint returns the full stack trace when an error occurs. The company must balance debugging needs with compliance requirements. Which recommendation best addresses the risks while maintaining operational visibility?

   • AEncrypt the logs and continue returning the full stack trace
   • BDisable all logging for the webhook endpoint and return generic error messages
   • CRedact sensitive fields in logs and return generic error messages to clients while logging detailed errors internally with restricted access
   • DKeep the full request logs but restrict access to them and return the full stack trace to clients
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is mass assignment in the context of API security?

   • AAn attack where an attacker sends extra parameters in a request to modify object properties that should not be accessible
   • BAn attack that floods an API with a large number of requests
   • CAn attack that injects malicious code into API responses
   • DAn attack that exploits weak authentication tokens
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is a denial-of-service vector specific to webhook delivery?

   • AUsing HTTPS to deliver webhooks
   • BFlooding the webhook endpoint with a large number of requests
   • CValidating webhook signatures
   • DSigning webhook payloads
   Reveal Solution Discussion Select an answer first