API Abuse WAHS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An API endpoint requires a valid JSON Web Token (JWT) to be accessed. However, any authenticated user can call the endpoint to retrieve another user's private profile data. Which security control is missing?

   • AAuthorization
   • BRate limiting
   • CEncryption
   • DAuthentication
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why can deprecated API endpoints be a security risk?

   • AThey use stronger encryption than current versions
   • BThey are always faster and more efficient, attracting attackers
   • CThey are automatically rate-limited, making them more secure
   • DThey may lack the security controls and fixes applied to newer versions, making them easier to exploit
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a mass assignment vulnerability in the context of APIs?

   • AAn attacker changes the HTTP method to access unintended endpoints
   • BAn attacker sends a large number of requests to overwhelm the API server
   • CAn attacker sends extra parameters in a request that are automatically bound to object properties, potentially modifying fields they should not be able to change
   • DAn attacker uses SQL injection to modify multiple database records at once
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A QA tester at a SaaS company discovers that sending a POST request to /api/v2/admin/users with a regular user's JWT successfully creates a new user with admin privileges. The endpoint is not documented in the public API reference, but it exists in the application's JavaScript bundle. Which two weaknesses combined create this vulnerability?

   • AMissing function-level authorization and exposed deprecated or undocumented admin endpoint
   • BCORS misconfiguration and verbose error messages
   • CWeak JWT secret and lack of rate limiting
   • DMass assignment and parameter pollution
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a common consequence of a lack of API logging and monitoring?

   • AThe API will be able to handle more requests
   • BThe API will become more secure because less data is stored
   • CAccess control violations may go undetected, allowing attackers to persist and cause damage
   • DThe API will automatically block all users after a failed attempt
   Reveal Solution Discussion Select an answer first