API Abuse WAHS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security engineer is reviewing an API that allows users to upload profile pictures. The endpoint POST /api/upload accepts a file and a 'userId' parameter. The application does not validate the file type and stores the file in a publicly accessible directory. An attacker uploads a file named 'profile.php' with malicious content and then accesses it directly. Which of the following is the most critical vulnerability and the best remediation?

   • ACORS misconfiguration; restrict allowed origins.
   • BBroken Object Level Authorization on the 'userId' parameter; enforce ownership checks.
   • CInsufficient rate limiting on the upload endpoint; add rate limiting.
   • DUnrestricted file upload leading to remote code execution; validate file type and store uploaded files outside the web root with random names.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is launching a public API that allows users to retrieve their own order history. The API uses API keys for authentication. The security team is concerned about brute-force attacks on the API keys and wants to implement rate limiting. However, they also want to ensure that legitimate users who make many requests (e.g., during a sale event) are not blocked. Which of the following is the most balanced approach?

   • AImplement per-user rate limiting with a high threshold and a burst allowance, and monitor for anomalies.
   • BDo not implement rate limiting; instead, rely on the API key complexity.
   • CImplement rate limiting only for unauthenticated requests.
   • DImplement a global rate limit for all users combined.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An API login endpoint has no rate limiting. What is the most likely consequence?

   • AThe API will log all requests, making it easier to detect attacks
   • BThe API will encrypt all traffic to prevent credential theft
   • CThe API will automatically block all users after a few failed attempts
   • DAn attacker can perform unlimited brute-force attempts to guess user credentials
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An attacker discovers that the API endpoint 'DELETE /api/admin/users' is accessible without any role check. This is an example of which vulnerability?

   • ACORS Misconfiguration
   • BBroken Function Level Authorization (BFLA)
   • CMass Assignment
   • DBroken Object Level Authorization (BOLA)
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is proper logging and monitoring important for API security?

   • AIt prevents all unauthorized access by blocking malicious requests
   • BIt automatically fixes vulnerabilities in the API
   • CIt allows security teams to detect and investigate access control violations and other suspicious activities
   • DIt encrypts all API traffic to protect data
   Reveal Solution Discussion Select an answer first