API and Java Web Token Penetration Testing CPENT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which standard JWT claim identifies the principal (e.g., a user) that is the subject of the token?

   • Aiss
   • Bsub
   • Caud
   • Dexp
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is 'excessive data exposure' in the context of API security?

   • AThe API accepts large payloads
   • BThe API uses too many endpoints
   • CThe API logs all requests
   • DThe API returns more data than the client needs, including sensitive fields
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the root cause that makes a JWT algorithm confusion attack possible?

   • AThe server uses a public key for encryption
   • BThe server uses a weak HMAC secret
   • CThe token has a long expiration time
   • DThe server does not restrict which algorithms it will accept for verification
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are testing an API that issues RS256-signed JWTs. The server's public key is exposed via a debug endpoint. You suspect the server does not restrict the JWT algorithm. Which payload modification would you try to escalate privileges?

   • AChange the payload and keep the original signature
   • BCrack the private key using hashcat
   • CChange alg to none and remove the signature
   • DChange alg to HS256, set the HMAC secret to the public key, and sign the token
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of an API security misconfiguration?

   • AImplementing rate limiting
   • BReturning detailed stack traces in error responses
   • CUsing HTTPS for all endpoints
   • DValidating input parameters
   Reveal Solution Discussion Select an answer first