API Abuse WAHS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An API uses OAuth 2.0 with scopes to control access. A client application requests the scope "read:orders" but the API also grants the "write:orders" scope because the authorization server does not properly filter requested scopes. A user authorizes the client, and the client then modifies orders. Which concept is most directly violated?

   • ARate limiting
   • BAuthentication
   • CInput validation
   • DAuthorization (scope-based access control)
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In the context of API security, what is the primary difference between authentication and authorization?

   • AAuthentication verifies the identity of a user or client, while authorization determines what actions or resources that identity is allowed to access.
   • BAuthentication is only used for machine-to-machine communication, while authorization is used for human users.
   • CAuthentication and authorization are interchangeable terms that both refer to verifying user credentials.
   • DAuthentication controls what resources a user can access, while authorization verifies the user's identity.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security team is implementing a monitoring solution for a critical API. They want to detect BOLA attacks where users access other users' data. The API currently logs the user ID and the requested resource ID, but does not log whether the request was authorized. Which of the following additional logging would be most effective for detecting BOLA attacks?

   • ALog the IP address of every request.
   • BLog the HTTP method and endpoint for every request.
   • CLog the response time for every request.
   • DLog the authorization decision (allowed/denied) for each request, along with the user ID and resource ID.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company's web application makes authenticated API calls to a backend service that returns sensitive user data. The API is configured with the following CORS header: Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true. A security auditor warns that this configuration is dangerous. Which of the following is the primary risk?

   • AThe API will be vulnerable to SQL injection because CORS headers are not properly sanitized.
   • BAny malicious website can make authenticated cross-origin requests to the API and read the responses, potentially stealing sensitive data.
   • CThe API will be unable to handle concurrent requests because of the wildcard origin.
   • DThe API will log all cross-origin requests, creating a privacy issue.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a common technique for API endpoint discovery?

   • AUsing a web application firewall (WAF) to block requests
   • BEnabling CORS to allow cross-origin requests
   • CImplementing rate limiting on the API
   • DReviewing public API documentation and Swagger/OpenAPI specifications
   Reveal Solution Discussion Select an answer first