Web Application API Attacks GCIH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst notices that the API gateway logs show a high number of 401 Unauthorized responses from a single IP address over a short period, followed by a successful 200 response. The pattern repeats every few minutes. What is the most likely interpretation?

   • AA credential-stuffing or brute-force attack that eventually succeeded.
   • BA misconfigured client that is sending invalid tokens due to clock skew.
   • CA normal user who forgot their password and is trying again.
   • DA distributed denial-of-service attack targeting the API.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is monitoring API logs and notices a sudden increase in 500 errors from a specific endpoint, along with requests containing unusual characters like single quotes and semicolons. Which type of attack is most likely being attempted?

   • ACredential stuffing
   • BDDoS attack
   • CSQL injection
   • DCross-site scripting (XSS)
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's mobile app uses a REST API for user profile updates. The API accepts a JSON payload with a 'user_id' field and returns the updated profile. During a security review, you notice that the API only checks that a valid session token is present, but does not verify that the token belongs to the user whose profile is being updated. An attacker could modify another user's profile by changing the 'user_id' in the request. What is the most effective control to implement?

   • AAdd object-level authorization checks that compare the authenticated user's ID with the 'user_id' in the request.
   • BLog all requests that include a 'user_id' different from the session's user ID.
   • CEncrypt the 'user_id' field in the JSON payload using a symmetric key.
   • DRequire the API key to be sent in the request header instead of the session token.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An e-commerce API allows users to search for products. The endpoint does not require authentication and has no rate limiting. An attacker writes a script that sends thousands of requests per minute to enumerate all product IDs and prices. Which combination of controls would best mitigate this abuse while minimizing impact to legitimate users?

   • AImplement per-IP rate limiting and require an API key for access.
   • BDisable the search endpoint entirely.
   • CIncrease the server's bandwidth and processing capacity.
   • DAdd a CAPTCHA to every search request.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A web application exposes a search endpoint that takes a 'q' parameter and uses it directly in a SQL query. An analyst observes a spike in requests containing patterns like 'q=1' OR '1'='1' -- and the API returns full database rows. The team wants to mitigate this without breaking legitimate search functionality. Which approach is the most appropriate first step?

   • AAdd a Web Application Firewall rule to drop requests with 'OR 1=1' patterns.
   • BIncrease logging for the search endpoint to capture more details.
   • CBlock all requests that contain single quotes in the 'q' parameter.
   • DUse parameterized queries for all database access in the search endpoint.
   Reveal Solution Discussion Select an answer first