Web Application API Attacks GCIH Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An e-commerce site's product search API is being hammered by a single IP address that sends thousands of requests per minute, causing performance degradation for legitimate users. The API currently has no request throttling. What is the most immediate and effective control to implement?

   • AIncrease the API server's capacity to handle the load.
   • BBlock the specific IP address at the firewall.
   • CImplement rate limiting per IP address, allowing a reasonable number of requests per minute and returning HTTP 429 when exceeded.
   • DAdd a CAPTCHA to the search API endpoint.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security analyst is reviewing API logs and notices a pattern: a single user account is making requests to /api/orders at a rate of 10 per second, each with a different 'order_id' parameter. The responses are all 200 OK. The account is a legitimate customer account. What is the most likely explanation?

   • AThe user has a misconfigured client that is sending duplicate requests.
   • BThe user is a normal customer checking their order status.
   • CThe API is experiencing a denial-of-service attack from this account.
   • DThe user is enumerating order IDs to access other customers' orders, indicating a possible IDOR attack.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following best describes the primary purpose of an API key in a web API?

   • ATo authorize specific user roles within the application
   • BTo encrypt the payload of every API request
   • CTo provide a unique identifier for each individual user
   • DTo authenticate the identity of the calling application or client
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   An attacker modifies a hidden field in an API request to change the price of an item from 10 to 1. Which type of attack is this?

   • AParameter tampering
   • BSQL injection
   • CCommand injection
   • DCross-site scripting (XSS)
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security operations team is reviewing API access logs. They notice a pattern: a single IP address makes requests to the /api/login endpoint with different usernames every few seconds, and the response times are consistently longer than normal. Which indicator is most suggestive of a credential stuffing attack?

   • AA high number of login attempts with different usernames from one IP.
   • BA single request to /api/login with a valid username and password.
   • CA spike in requests to /api/health from multiple IPs.
   • DRequests to /api/products with a normal user-agent.
   Reveal Solution Discussion Select an answer first