API and Java Web Token Penetration Testing CPENT Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary goal of API authorization testing?

   • ATo discover hidden API endpoints
   • BTo verify that users can only access resources and perform actions they are permitted to
   • CTo check if the API uses HTTPS
   • DTo test the API's response time
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   You are testing an API that uses JWT for authentication. You have a valid token for a regular user. You want to test for privilege escalation by modifying the token. The server uses RS256. Which approach is most likely to succeed?

   • AUse the token as-is but add an 'admin' claim to the payload.
   • BChange the algorithm to 'none' and remove the signature.
   • CChange the role claim to 'admin' and re-sign the token with the same RS256 private key.
   • DAttempt an algorithm confusion attack by switching to HS256 and using the public key as the secret, then change the role claim to 'admin'.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which API authentication method involves the client presenting a unique identifier that is typically included in an HTTP header, and the server treats this identifier as a bearer credential without requiring a signature or session?

   • AMutual TLS
   • BJWT bearer token
   • CAPI key
   • DOAuth 2.0 client credentials grant
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the most common way to test an API parameter for SQL injection?

   • ASubmit a long string to test buffer overflow
   • BSubmit a valid JSON object
   • CSubmit a single quote and observe for database error messages
   • DSubmit a large file upload
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A web API accepts JWTs for authentication. During testing, you send a token with the header 'alg': 'none' and an empty signature. The API returns a 200 OK response with the user's profile. Which vulnerability is present?

   • AThe server uses a weak HMAC secret
   • BThe server has an IDOR vulnerability
   • CThe server is vulnerable to algorithm confusion
   • DThe server does not enforce signature verification
   Reveal Solution Discussion Select an answer first