Web Application API Attacks GCIH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An attacker repeatedly calls a login API endpoint with different username and password combinations. Which type of attack is this primarily exploiting?

   • ABrute-force attack
   • BCross-site request forgery (CSRF)
   • CDenial of service (DoS)
   • DSQL injection
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A cloud storage API allows users to share files with a link. The API endpoint /file/{id} returns the file metadata and content if the requester has a valid share token. A security researcher finds that the share token is a sequential integer and that the API does not check if the token has been revoked. The company wants to fix this while maintaining the ability to share files. Which solution is the most secure?

   • AKeep sequential tokens but add a rate limit to the endpoint.
   • BRequire the file owner to be logged in to access the share link.
   • CEncrypt the file content so that only the owner can decrypt it.
   • DReplace sequential share tokens with unguessable random tokens and enforce revocation checks on every request.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company's API gateway is configured to allow all HTTP methods and does not enforce TLS on the backend connection. An attacker performs a man-in-the-middle attack and modifies API responses. The company wants to ensure data integrity and prevent unauthorized method usage. Which combination of controls is the most appropriate?

   • ADisable all HTTP methods except GET to simplify security.
   • BUse IP allowlisting on the backend to only accept traffic from the gateway.
   • CAdd a custom header to all requests and verify it at the backend.
   • DEnforce TLS between the gateway and backend, and restrict allowed HTTP methods to those required by the API.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A development team exposes an internal API to the internet. The API supports GET, POST, PUT, DELETE, and OPTIONS. The team wants to minimize the attack surface while keeping the API functional for its intended read and create operations. Which configuration is the most appropriate?

   • ALeave the configuration as is and rely on the network firewall to block external access.
   • BDisable PUT and DELETE methods at the web server or API gateway, leaving only GET and POST enabled.
   • CKeep all methods enabled but require a strong API key for every request.
   • DEnable only GET requests and move all create operations to a separate admin API.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A public API that provides stock quotes is being scraped by a competitor. The competitor uses a rotating set of IP addresses to bypass simple IP-based rate limits. The API still needs to serve anonymous users. What is the most effective way to limit scraping?

   • AIncrease the IP-based rate limit to allow more requests per IP.
   • BRequire an API key for every request and enforce per-key rate limits.
   • CBlock all requests that do not have a browser User-Agent header.
   • DAdd a JavaScript challenge to the API responses.
   Reveal Solution Discussion Select an answer first