API Abuse WAHS Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security operations team is investigating a potential BFLA attack on an API. The API logs show that a regular user repeatedly called an admin endpoint and received 200 OK responses, but the logs do not include the request body or the user's role. The team cannot determine if the attack succeeded or what data was accessed. Which improvement to logging would most directly help in future investigations?

   • AEnable verbose error messages in API responses
   • BLog the authenticated user ID, role, endpoint, HTTP method, request parameters, and response status for every API request
   • CLog only the IP address and timestamp of each request
   • DAdd rate limiting to the admin endpoint
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company's API is used by both a web application at https://app.example.com and a mobile app. The API currently allows any Origin header to be reflected with Access-Control-Allow-Credentials: true to support the mobile app. A security consultant warns that this is dangerous. The company wants to keep the mobile app functional. What is the best remediation?

   • ARemove CORS headers entirely from the API
   • BKeep reflecting any Origin but disable Access-Control-Allow-Credentials
   • CRestrict CORS to a allowlist of trusted web origins and do not rely on CORS for mobile apps, which do not enforce CORS
   • DUse a wildcard origin * and allow credentials
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is the best defense against injection attacks in APIs?

   • ADisabling CORS entirely
   • BIncreasing the API rate limit
   • CUsing a WAF to block all requests with special characters
   • DUsing parameterized queries and strict input validation
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   During a penetration test, you are asked to map the attack surface of a REST API. You have access to the main documentation at /api/docs, but you suspect there are undocumented endpoints. Which of the following techniques is most effective for discovering hidden API endpoints and parameters?

   • ACheck the server's DNS records for subdomains that might host the API.
   • BSend a GET request to every possible HTTP method on the root path and observe the responses.
   • CIntercept all traffic from the web application and replay every request with modified headers.
   • DUse a wordlist-based content discovery tool against the API base path, and also analyze JavaScript files and mobile app traffic for endpoint references.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which of the following is the best practice to prevent Broken Function Level Authorization (BFLA) vulnerabilities?

   • AEnforce role-based access control (RBAC) on every API function, especially administrative endpoints
   • BHide administrative endpoints by using obscure URLs
   • CUse HTTP methods like POST instead of DELETE for sensitive operations
   • DRely on client-side hiding of admin buttons
   Reveal Solution Discussion Select an answer first