API Abuse WAHS Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A web application at https://app.example.com makes authenticated API calls to https://api.example.com. The API is configured with the following CORS headers: Access-Control-Allow-Origin: https://app.example.com and Access-Control-Allow-Credentials: true. A security tester discovers that the API also reflects any Origin header sent in the request, as long as it ends with example.com. Which of the following is the most likely risk?

   • AThe API will be unable to handle requests from the legitimate app because the origin is not exact.
   • BThe API is vulnerable to SQL injection because of the CORS reflection.
   • CAn attacker can host a malicious page on attacker.example.com and make authenticated cross-origin requests to the API, potentially reading sensitive data.
   • DThe API will log all cross-origin requests, creating a privacy issue.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary risk of a CORS misconfiguration in an API?

   • AThe API will become vulnerable to SQL injection
   • BThe API will be unable to handle HTTPS requests
   • CThe API will automatically log all requests, causing a privacy issue
   • DAn attacker can make cross-origin requests from a malicious website to the API, potentially reading sensitive responses
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A financial services company exposes a login API endpoint that accepts username and password. Security monitoring has detected a high volume of requests from a single IP address, each with different passwords for the same username. The application does not currently limit the number of login attempts. Which of the following is the most effective control to mitigate this specific attack while minimizing impact on legitimate users?

   • ADisable the login endpoint and require users to authenticate via a VPN.
   • BImplement rate limiting and account lockout after a threshold of failed attempts, with a lockout duration that balances security and usability.
   • CIncrease the password minimum length to 20 characters for all users.
   • DAdd a CAPTCHA to the login form for all users, regardless of the number of attempts.
   Reveal Solution Discussion Select an answer first
5. 34application · medium · select all that apply

   A security consultant is reviewing an API that manages a document repository. The API uses JWT for authentication and has the following characteristics: (1) Users can access documents by changing the document ID in the URL without any ownership check. (2) The endpoint GET /api/admin/users is accessible to any authenticated user, not just administrators. (3) The API does not log access to documents. Which of the following OWASP API Security Top 10 risks are present? Select all that apply.

   • ABroken Function Level Authorization (BFLA)
   • BSecurity Misconfiguration
   • CInsufficient Logging and Monitoring
   • DMass Assignment
   • EBroken Object Level Authorization (BOLA)
   Check answers Discussion Select an answer first
6. 35application · medium

   A security team is investigating a potential data breach involving an API. They suspect that an attacker exploited a BOLA vulnerability to access other users' data. However, the API logs only successful requests and do not record the authenticated user ID or the requested object ID. Which of the following is the most significant impact of this logging gap?

   • AThe API will automatically block malicious requests because of the logging gap.
   • BThe API will be vulnerable to SQL injection because logging is not enabled.
   • CThe API will be slower because logging is incomplete.
   • DThe team cannot reconstruct which user accessed which object, making it difficult to determine the scope of the breach and identify affected accounts.
   Reveal Solution Discussion Select an answer first