Parameter Tampering WAHS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How can encryption or integrity checks help mitigate parameter tampering?

   • ABy using a signed token or HMAC to ensure that parameters have not been altered in transit.
   • BBy using a VPN to secure the connection between the client and server.
   • CBy encrypting the entire database so that parameters cannot be read.
   • DBy hiding parameters in the URL using POST requests.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A penetration tester is assessing a web application that has a 'role' parameter in a POST request. The application also uses a server-side session that stores the user's role. The tester changes the 'role' parameter to 'admin' but the application still responds with 'user' privileges. Which of the following is the most likely reason the attack failed?

   • AThe server correctly ignores the client-supplied 'role' parameter and uses the session value
   • BThe server encrypts the 'role' parameter and the tester's value is not properly encrypted
   • CThe server uses a WAF that blocks requests with modified 'role' parameters
   • DThe server validates the 'role' parameter against a list of allowed values
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is developing a web application that processes payments. The application uses a 'discountCode' parameter in the request to apply a discount. The development team wants to prevent users from tampering with the discount code to get unauthorized discounts. Which of the following is the most robust mitigation?

   • AValidate the discount code server-side against a list of valid codes and ensure it is tied to the user's account.
   • BEncrypt the discount code using a secret key and decrypt it on the server.
   • CUse a client-side JavaScript to verify that the discount code is valid before submission.
   • DStore the discount code in a cookie and compare it with the server's copy.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is an effective countermeasure to prevent parameter tampering?

   • ADisabling JavaScript in the user's browser.
   • BUsing a longer URL for each request.
   • CValidating and sanitizing all parameters on the server side.
   • DStoring all application data in cookies.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A development team is tasked with fixing a parameter tampering vulnerability in a legacy application. The application uses a 'userID' parameter in URLs to fetch user profiles. The team wants to minimize changes to the existing codebase while ensuring security. Which approach best balances security and minimal code changes?

   • AReplace all 'userID' parameters with encrypted tokens
   • BAdd a server-side check that compares the 'userID' parameter with the authenticated session's user ID
   • CImplement a WAF rule to block requests with modified 'userID' parameters
   • DRemove the 'userID' parameter and use the session ID for all profile access
   Reveal Solution Discussion Select an answer first