You are using Burp Suite to fuzz an API endpoint. You want to automate the discovery of SQL injection vulnerabilities in multiple parameters. Which approach is most effective?

Use Burp Repeater to send a single payload to one parameter.

Manually send a few payloads to each parameter and observe the responses.

Use Burp Intruder with a payload list of SQLi payloads and a resource pool that handles rate limiting, then analyze responses for errors or anomalies.

Use Burp Scanner's active scan, but only on the login endpoint.

You are testing an API login endpoint. The API uses JWTs for session management. You notice that the login endpoint does not have rate limiting, and the JWT secret is a common word. Which combination of attacks is most likely to succeed?

Exploit SQL injection in the login form

Use the none algorithm to bypass authentication

Perform an IDOR attack on the login endpoint

Brute-force the login, then crack the JWT secret to forge tokens

You are reviewing an API that uses API keys for authentication. You notice that the API key is sent as a query parameter in the URL. What is the primary security concern with this practice?

The API key is not validated by the server.

The API key cannot be revoked if compromised.

The API key is not encrypted during transmission.

The API key may be logged in server logs, proxy logs, or browser history, leading to leakage.

You are testing a REST API that accepts a 'userId' parameter. You want to identify injection points and unexpected behavior. Which approach is most appropriate?

Check if the API returns verbose error messages

Test the API with different HTTP methods (GET, POST, PUT, DELETE)

Send a range of malicious payloads (SQLi, XSS, command injection) in the userId parameter

Enumerate all API endpoints using a wordlist

EC-CouncilCertified Penetration Testing Professional

Domain 3Objective 2

API and Java Web Token Penetration Testing CPENT Practice Questions (Page 4)

Part of the Web and API Penetration Testing domain, which makes up ~15% of our current practice bank.

68questions here

14free pages

17concepts

17 Concepts in This Objective

API Authentication Mechanisms
JWT Structure and Claims
JWT Signing Algorithms
JWT Vulnerabilities
JWT Token Manipulation
API Endpoint Enumeration
API Parameter Fuzzing
API Authentication Bypass
API Authorization Testing
API Input Validation Testing
API Rate Limiting and Abuse
API Security Misconfigurations
JWT Secret Cracking
JWT Algorithm Confusion Attack
JWT None Algorithm Attack
API Fuzzing Tools Usage
API Security Testing Methodology

Questions 16–20

16expert · hard
You are using Burp Suite to fuzz an API endpoint. You want to automate the discovery of SQL injection vulnerabilities in multiple parameters. Which approach is most effective?
Select an answer first
17expert · hard
You are testing an API login endpoint. The API uses JWTs for session management. You notice that the login endpoint does not have rate limiting, and the JWT secret is a common word. Which combination of attacks is most likely to succeed?
Select an answer first
18application · medium
You need to automate fuzzing of an API's parameters to test for injection and unexpected behavior. Which tool is best suited for this task?
Select an answer first
19application · medium
You are reviewing an API that uses API keys for authentication. You notice that the API key is sent as a query parameter in the URL. What is the primary security concern with this practice?
Select an answer first
20application · medium
You are testing a REST API that accepts a 'userId' parameter. You want to identify injection points and unexpected behavior. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.