API and Java Web Token Penetration Testing CPENT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary defense against the JWT none algorithm attack?

   • AUse a shorter expiration time
   • BUse a longer HMAC secret
   • CReject tokens with the 'alg' header set to 'none'
   • DEncrypt the JWT payload
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which type of input is commonly used in API parameter fuzzing to test for SQL injection?

   • ARandom UUIDs
   • BLarge integers
   • CHTML tags
   • DSingle quotes and SQL keywords
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a sign of weak API authentication that a tester should look for?

   • AThe API returns JSON responses
   • BThe API accepts requests without any authentication token
   • CThe API has rate limiting
   • DThe API uses HTTPS
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An API uses OAuth 2.0 with the authorization code grant. You intercept an authorization code and notice that it can be used multiple times. Which flaw is this?

   • AAuthorization code reuse
   • BJWT none algorithm
   • CRate limiting deficiency
   • DIDOR
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which JWT attack is possible when a server uses HS256 and the HMAC secret is a short, easily guessable value?

   • AAlgorithm confusion attack
   • BNone algorithm attack
   • CJWT payload tampering
   • DWeak secret brute-forcing
   Reveal Solution Discussion Select an answer first