EC-CouncilWeb Application Hacking and Security
Domain 1Objective 4
API Abuse WAHS Practice Questions (Page 12)
Part of the Broken Access Control domain, which makes up ~23% of our current practice bank. EC-Council does not publish an official question count, but from its 360-minute exam (~145–240 total, ~33–55 in this domain), expect 7–11 from this objective — we provide 63 practice questions to prepare you well beyond it. (estimate)
63questions here
13free pages
14concepts
Questions 56–60
- 56
An attacker sends a POST request to update a user profile and includes an extra field 'isAdmin': true. The server updates the user's record and grants admin privileges. Which vulnerability is this?
Select an answer first - 57
A developer at a startup implements JWT-based authentication for their API. The JWT library is configured to accept both HS256 and RS256 algorithms. An attacker obtains a valid RS256 token, changes the algorithm header to HS256, and signs the token with the server's public key (which is available at /api/v1/jwks). The server accepts the token and grants admin access. Which JWT vulnerability is being exploited?
Select an answer first - 58
Which of the following is the most effective defense against Broken Object Level Authorization (BOLA) vulnerabilities?
Select an answer first - 59
An attacker changes the value of 'user_id' in a GET request from '123' to '124' and receives the profile of another user. Which vulnerability is being exploited?
Select an answer first - 60
An attacker finds that API version 'v1' still allows a vulnerable endpoint that was fixed in 'v2'. This is an example of which issue?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “WAHS” is a trademark of its owner, used for identification only.