API and Java Web Token Penetration Testing CPENT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary difference between HS256 and RS256 JWT signing algorithms?

   • AHS256 is only for encryption, while RS256 is only for signing
   • BHS256 uses a public key to sign, while RS256 uses a private key to verify
   • CHS256 is asymmetric, while RS256 is symmetric
   • DHS256 uses a symmetric key, while RS256 uses an asymmetric key pair
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During an API test, you find that the API returns full stack traces and internal IP addresses in error messages. Which security misconfiguration is this?

   • AImproper error handling
   • BExcessive data exposure
   • CBroken authentication
   • DInsecure defaults
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which tool is commonly used to intercept, modify, and replay API requests for fuzzing?

   • ANmap
   • BWireshark
   • CBurp Suite
   • DMetasploit
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You are testing an API endpoint that accepts a 'search' parameter. You send the value "' OR '1'='1" and the API returns all records. Which vulnerability is present?

   • ABroken object-level authorization
   • BSQL injection
   • CCommand injection
   • DCross-site scripting (XSS)
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is RS256 generally considered more secure than HS256 for JWT signing in a distributed system?

   • ARS256 is faster than HS256
   • BRS256 allows verification without sharing the signing key
   • CRS256 uses a longer key by default
   • DRS256 does not require any key management
   Reveal Solution Discussion Select an answer first