Web Services Security GWEB Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing the logging configuration for a REST API. The API is frequently targeted by credential stuffing attacks. Which logging practice would best support detection and investigation of these attacks?

   • ALog the response status code only, without any request details.
   • BLog the full request body including passwords for every request.
   • CLog the source IP address, timestamp, and the username attempted for every authentication request.
   • DLog only successful authentication requests to reduce log volume.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company operates a public API that uses API keys for authentication. A partner's API key is compromised, and the attacker uses it to make a high volume of requests. The company's rate limiting is based on the API key. The legitimate partner also uses the same key from multiple servers. Which approach best balances security and availability?

   • AKeep the key active but add a CAPTCHA challenge for all requests using that key.
   • BIncrease the rate limit for the compromised key to ensure the partner's servers are not blocked.
   • CRevoke the compromised key immediately and issue a new key to the partner, then implement per-IP rate limiting as a secondary control.
   • DDisable rate limiting for the partner's account until the issue is resolved.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary goal of rate limiting in a web service?

   • ATo increase the speed of legitimate requests by prioritizing them.
   • BTo prevent a single client from overwhelming the service with too many requests.
   • CTo validate the format of incoming data.
   • DTo encrypt all requests and responses.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A development team is building a REST API that accepts JSON payloads. The API uses a JavaScript runtime and merges user-supplied JSON into a configuration object. A security review warns that an attacker could send a JSON payload with a key like "__proto__" to alter the object's prototype. Which mitigation is most effective?

   • ASwitch from JSON to XML for all API requests.
   • BUse a JSON schema validator that rejects keys starting with "__" or containing "constructor" and "prototype".
   • CEncode all JSON responses using base64 before sending them to clients.
   • DUse a deep merge function that recursively copies all properties, including inherited ones.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company exposes a REST API that must be accessed by a legacy client that only supports TLS 1.0. The security team requires all traffic to be encrypted. What is the best approach?

   • AUse a VPN tunnel for the legacy client
   • BEnable TLS 1.0 on the server to maintain compatibility
   • CUpgrade the client to support TLS 1.2 or higher, even if it requires a client-side update
   • DAllow HTTP for the legacy client only
   Reveal Solution Discussion Select an answer first