Web Application API Attacks GCIH Practice Questions (Page 10)

Questions 46–49

1. 46expert · hard

   A healthcare API returns patient records. The API uses OAuth 2.0 with scopes to control access. A developer notices that the 'patient:read' scope returns the full medical history, including mental health notes, but the mobile app only needs basic demographics. The API is also returning verbose error messages that reveal database schema details. Which two issues are present?

   • AImproper CORS policy and insecure HTTP methods.
   • BExcessive data exposure and information disclosure through error messages.
   • CBroken object-level authorization and missing rate limiting.
   • DCommand injection and parameter tampering.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard · select all that apply

   A security analyst is reviewing API logs and identifies the following indicators: a high number of requests to /api/v1/search with a 'q' parameter containing SQL-like syntax, a spike in 500 errors, and requests originating from a single IP address at a rate of 100 requests per second. Which of the following attacks are likely occurring? Select all that apply.

   • ACredential stuffing
   • BCross-site scripting (XSS)
   • CDenial of service (DoS)
   • DSQL injection
   Check answers Discussion Select an answer first
4. 48application · medium

   A financial app's API endpoint /account/{id} returns the full account object, including internal fields like 'internal_notes' and 'routing_number', to any authenticated user who knows the account ID. The API does not check whether the user owns the account. What is the primary vulnerability?

   • ABroken object-level authorization combined with excessive data exposure.
   • BVerbose error messages that reveal internal field names.
   • CInsecure direct object reference only, because the attacker can guess the ID.
   • DMissing rate limiting, allowing the attacker to enumerate account IDs.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   During an API incident, which of the following is the FIRST step in the incident response process?

   • AEradicate the root cause of the incident
   • BRecover systems to normal operation
   • CIdentify and confirm that an incident has occurred
   • DContain the incident to prevent further damage
   Reveal Solution Discussion Select an answer first