Web Application API Attacks GCIH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is the most effective way to detect a brute-force attack against an API login endpoint?

   • AChecking for the presence of SQL keywords in request bodies
   • BMonitoring for a high number of failed login attempts from a single IP address
   • CMonitoring for unusual response times on the login endpoint
   • DReviewing API documentation for outdated endpoints
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is the most effective defense against SQL injection in an API endpoint that accepts user input for database queries?

   • AEncoding all input with URL encoding
   • BUsing a web application firewall (WAF) as the only defense
   • CUsing parameterized queries or prepared statements
   • DBlocking requests that contain the word 'SELECT'
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An API that handles user password changes is under attack. The attacker is using a script to submit many password-change requests with different current passwords, and the API returns a generic error message for wrong passwords. The team wants to slow down the attack while maintaining a good user experience. Which control is most appropriate?

   • AAdd a CAPTCHA to the password-change form.
   • BDisable the password-change endpoint temporarily.
   • CImplement rate limiting on the password-change endpoint, allowing only a few attempts per minute per account.
   • DIncrease the password complexity requirements.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An API accepts a JSON payload with a 'sort' field that is used to order results. The API uses this field directly in a database query. A penetration test reveals that the 'sort' field is vulnerable to SQL injection. The development team wants to fix it, but they also need to support dynamic sorting by multiple fields. Which solution best balances security and functionality?

   • AUse an allowlist of sortable fields and map the input to safe column names.
   • BUse a stored procedure for sorting.
   • CSanitize the 'sort' field by removing single quotes and semicolons.
   • DDisable the sorting feature entirely.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A user reports that when they enter an invalid account number in a banking API, the response includes a detailed stack trace with database table names and SQL query fragments. What is the primary security issue?

   • AInsecure direct object reference because the account number is in the URL.
   • BBroken authentication because the API does not require a token.
   • CVerbose error messages that leak internal implementation details.
   • DMissing rate limiting that allows repeated invalid requests.
   Reveal Solution Discussion Select an answer first