API and Java Web Token Penetration Testing CPENT Practice Questions (Page 14)

Questions 66–68

1. 66expert · hard

   During an API assessment, you find that the API returns verbose error messages that include SQL queries. You also notice that the API exposes an undocumented endpoint that allows user enumeration. Which misconfiguration is the most critical to report?

   • AThe lack of rate limiting on the undocumented endpoint.
   • BThe undocumented endpoint that allows user enumeration, as it leaks valid usernames.
   • CThe use of JWT for authentication, as it may be vulnerable to algorithm confusion.
   • DVerbose error messages that reveal SQL queries, as they can directly aid SQL injection attacks.
   Reveal Solution Discussion Select an answer first
2. 67foundation · easy

   What is the first phase in a structured API penetration testing methodology?

   • AReporting
   • BExploitation
   • CDiscovery and enumeration
   • DRemediation
   Reveal Solution Discussion Select an answer first
3. 68application · medium

   You are starting an API penetration test. You have a valid API key and the base URL. Which sequence of steps best follows a structured methodology?

   • AOnly test the documented endpoints
   • BExploit vulnerabilities immediately, then document them
   • CDiscover endpoints, analyze authentication, test authorization, then test input validation
   • DTest input validation first, then discover endpoints
   Reveal Solution Discussion Select an answer first