API Abuse WAHS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An attacker intercepts a request and changes the 'role' parameter from 'user' to 'admin'. The server grants admin privileges. Which vulnerability is this?

   • AParameter Manipulation
   • BHTTP Verb Tampering
   • CAPI Versioning
   • DCORS Misconfiguration
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the goal of API enumeration and discovery?

   • ATo encrypt all API traffic to protect sensitive data
   • BTo map out the API's endpoints, parameters, and methods to understand the attack surface
   • CTo rate limit requests to prevent abuse
   • DTo validate input parameters to prevent injection
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is tasked with mapping the attack surface of a REST API. The analyst has access to the API's Swagger documentation, a JavaScript bundle from the web app, and a list of common API paths. Which approach would most effectively discover undocumented and deprecated endpoints that might lack proper access controls?

   • AUse a wordlist of common usernames and passwords against the login endpoint
   • BCombine Swagger docs with JavaScript bundle analysis and fuzzing of common path patterns
   • CSend OPTIONS requests to the root path to list all available endpoints
   • DOnly test the endpoints listed in the Swagger documentation
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of API rate limiting?

   • ATo limit the number of requests a client can make within a given time period, preventing brute-force attacks and resource exhaustion
   • BTo encrypt all API traffic between client and server
   • CTo authenticate users before they can access the API
   • DTo validate input parameters to prevent injection attacks
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A developer is building a REST API and needs to decide how to handle authentication and authorization. The API will be used by a mobile app and a web app. The developer wants to ensure that only authenticated users can access certain endpoints, and that only users with the 'admin' role can access administrative endpoints. Which of the following approaches is the most secure and appropriate?

   • AUse HTTP Basic Authentication and check the role in the client-side code.
   • BUse OAuth 2.0 with scopes for authentication and implement role-based access control (RBAC) in the API for authorization.
   • CUse JWT with the user's role embedded in the token and trust the token's role claim without server-side verification.
   • DUse a shared API key for all users and rely on the client to hide administrative endpoints.
   Reveal Solution Discussion Select an answer first