Web Services Security GWEB Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A web service accepts a 'quantity' field in a JSON payload. Which validation approach is most appropriate to prevent malformed data?

   • AConvert the field to a float and round it.
   • BEnsure the field is an integer within an acceptable range (e.g., 1 to 1000).
   • CCheck that the field is a string and contains only digits.
   • DRemove any non-numeric characters from the input.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A web application uses a JavaScript library that recursively merges configuration objects. An attacker submits a JSON payload that includes a key named "__proto__" with a value of {"isAdmin": true}. What is the most likely result?

   • AThe application crashes due to a stack overflow.
   • BThe JSON parser throws an error because "__proto__" is not a valid key.
   • CThe merge operation ignores the key because it is a special JavaScript property.
   • DThe object's prototype is polluted, potentially granting the attacker elevated privileges.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A REST API accepts JSON payloads and stores them in a NoSQL database. Which attack is most directly related to insufficient validation of JSON field names and values?

   • ANoSQL injection
   • BJSON injection (e.g., injecting unexpected fields or malformed data)
   • CXML injection
   • DLDAP injection
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial services company exposes a SOAP-based web service for account balance inquiries. During a penetration test, the tester submits a SOAP request with a crafted XML document that includes an external entity referencing a local file. The service returns the file contents in the response. Which single control would most directly prevent this attack while preserving the service's functionality?

   • ADisable DTD processing and external entity resolution in the XML parser.
   • BRequire HTTP Basic Authentication for all SOAP requests.
   • CAdd a WSDL validation step to ensure only expected SOAP operations are invoked.
   • DSet the SOAPAction header to a fixed value for all requests.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A public API is experiencing a denial-of-service attack where attackers use many different IP addresses to send requests. The API currently has per-IP rate limiting. What additional control would be most effective?

   • AIncrease the per-IP rate limit to allow more requests
   • BAdd a CAPTCHA to all API requests
   • CDisable rate limiting entirely
   • DImplement rate limiting based on API keys or user accounts
   Reveal Solution Discussion Select an answer first