Web Application Penetration Testing CPENT Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   You are testing a REST API that uses API keys in the Authorization header. The API returns full user objects, including password hashes, when a client requests /users/{id}. You also notice that the API does not enforce rate limiting on the login endpoint. Which two findings should you report?

   • ABroken authentication and mass assignment
   • BExcessive data exposure and missing rate limiting
   • CSecurity misconfiguration and SQL injection
   • DInsecure direct object reference and CSRF
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   In API security testing, what does 'mass assignment' refer to?

   • AAn attacker sends extra parameters in a request that are automatically bound to internal object properties
   • BAn attacker injects malicious code into API parameters
   • CAn attacker sends a large number of requests to overwhelm the server
   • DAn attacker uses a script to enumerate all API endpoints
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   You are testing a REST API that uses JWT for authentication. The API has an endpoint '/api/users/{id}' that returns user details. You discover that by changing the 'id' parameter, you can access other users' data without authorization. The API also accepts a 'role' field in the POST request to '/api/users' and sets the user's role to whatever is provided. Which two vulnerabilities are present?

   • ARate limiting and DoS; implement throttling and request validation
   • BIDOR and mass assignment; implement object-level access control and an allowlist for role assignment
   • CBroken authentication and CSRF; implement MFA and anti-CSRF tokens
   • DSQL injection and XSS; use parameterized queries and output encoding
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A web application has a search feature that is vulnerable to SQL injection, but a WAF blocks common payloads. You have confirmed the injection exists by using a boolean-based blind technique. You now need to extract data, but the WAF also blocks the keywords 'union', 'select', and 'from'. Which approach is most likely to succeed?

   • AUse a time-based blind injection with conditional delays, such as 'IF(condition, WAITFOR DELAY '0:0:5', 0)'
   • BUse a stacked query to execute multiple statements
   • CUse an out-of-band channel via DNS, such as 'exec xp_dirtree'
   • DUse a UNION-based injection with inline comments to break up the keywords
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   In threat modeling for a web application, which activity is primarily used to identify and prioritize potential attack vectors based on the application's architecture and data flow?

   • ACreating a data flow diagram (DFD) and identifying trust boundaries
   • BRunning an automated vulnerability scanner
   • CTesting the application with a fuzzer
   • DReviewing the application's source code for SQL injection
   Reveal Solution Discussion Select an answer first