Web Application API Attacks GCIH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An API allows clients to use the HTTP DELETE method to remove resources, but the API documentation states that only GET and POST should be supported. Which type of misconfiguration is this?

   • AInsecure HTTP methods
   • BImproper CORS policy
   • CVerbose error messages
   • DMissing security headers
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A large healthcare organization exposes a patient portal API. The API uses OAuth 2.0 with bearer tokens that expire after 15 minutes. A security audit reveals that the API also accepts a legacy 'patient_id' parameter in the URL, and if provided, it overrides the authenticated user's identity. The API returns full medical records. The organization wants to maintain the ability for authorized staff to access patient records on behalf of patients, but must prevent unauthorized access. Which solution best balances security and functionality?

   • AEncrypt the 'patient_id' parameter so that only authorized clients can generate valid values.
   • BKeep the 'patient_id' parameter but add a check that the authenticated user has a 'staff' role.
   • CRemove the 'patient_id' parameter and require staff to use a separate, audited admin endpoint that enforces role-based access control.
   • DLog all requests that include a 'patient_id' and review them weekly.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During an incident, an API endpoint that allows file uploads is found to be vulnerable to command injection. Attackers have been exploiting it to run arbitrary commands on the server. The development team needs time to patch the code. Which immediate mitigation should be applied first?

   • ADisable the server's command-line interface.
   • BIncrease logging for the endpoint.
   • CRotate all API keys.
   • DBlock the vulnerable endpoint at the WAF or gateway.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a common characteristic of token-based authentication in web APIs?

   • AThe server stores the token in a database and checks it on every request
   • BThe token is typically sent in the Authorization header of each request
   • CThe token is a static value that never expires
   • DThe token is only used during the initial login and never again
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An API that allows users to upload files is being abused to host malware. The API has no file type restrictions and no size limit. The company wants to continue allowing file uploads but must prevent malware hosting. Which control is the most effective?

   • ALimit the file size to 1 MB.
   • BRestrict file types to a whitelist of allowed extensions.
   • CStore uploaded files on a separate domain with no execution privileges.
   • DScan all uploaded files with antivirus software and reject files that are flagged as malicious.
   Reveal Solution Discussion Select an answer first