API Reconnaissance and Model Fingerprinting COASP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During API reconnaissance, which technique is most effective for discovering undocumented API endpoints from a web application?

   • AReading the robots.txt file for disallowed paths
   • BChecking the HTTP response headers for API version numbers
   • CPerforming a port scan on the web server
   • DIntercepting and analyzing network traffic while using the application
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security tester is assessing an AI API that uses API keys for authentication. The tester discovers that the API key is included in the URL query string of some requests. The tester wants to test for authorization vulnerabilities. Which action is most appropriate?

   • AAttempt to use the API key from a different client to see if it grants the same permissions.
   • BSend a request without the API key to see if the API returns an error message that reveals information.
   • CCheck if the API key in the query string is logged in server logs or accessible via referrer headers.
   • DTry to access other users' resources by modifying the resource ID in the request while using the same API key.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are assessing an AI API that uses rate limiting based on both IP address and API key. You have a valid API key but need to perform a large number of requests for a thorough test. You also want to avoid being blocked. Which strategy is most effective?

   • AUse a pool of proxy IP addresses and rotate the API key with multiple valid keys if available.
   • BUse a single IP and a single API key but increase the delay between requests to stay under the limit.
   • CUse a single IP but change the User-Agent header for each request to avoid detection.
   • DRequest a higher rate limit from the API provider by explaining the assessment.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   You are testing an image classifier API that has a rate limit of 100 requests per hour. You need to generate adversarial examples that cause misclassification. You have a local dataset of images similar to the training data. Which approach is most effective given the rate limit?

   • ASend random noise to the API and hope for misclassifications.
   • BUse a genetic algorithm to evolve adversarial examples by querying the API hundreds of times.
   • CUse a black-box attack that queries the API with many perturbed images to estimate gradients.
   • DTrain a surrogate model on your local dataset, generate adversarial examples using white-box attacks, and test a small subset on the API to confirm transferability.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of a payload used to test for SQL injection in an API parameter?

   • A' OR '1'='1
   • BGET /admin HTTP/1.1
   • C../../etc/passwd
   • D<script>alert(1)</script>
   Reveal Solution Discussion Select an answer first