Web Services Security GWEB Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key consideration when logging web service requests to ensure security monitoring is effective?

   • ADisabling logging for successful requests to reduce noise.
   • BLogging full request and response bodies, including sensitive data, for complete visibility.
   • CStoring logs only in memory to avoid disk space issues.
   • DEnsuring logs are tamper-evident and protected from unauthorized modification.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common attack surface that is more specific to SOAP-based web services than to typical REST APIs?

   • AExploiting prototype pollution via deeply nested JSON objects.
   • BAbusing HTTP method override headers to bypass access controls.
   • CManipulating the SOAP envelope's header to alter routing or authentication information.
   • DInjecting malicious JSON payloads into the request body.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a recommended best practice for securing a web service API according to OWASP?

   • AUse only GET requests to avoid exposing data in URLs.
   • BRely on security through obscurity by keeping API endpoints secret.
   • CImplement proper authentication and authorization checks on every endpoint.
   • DDisable all logging to prevent information leakage.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is setting up monitoring for a REST API that has been targeted by credential stuffing attacks. The analyst wants to detect the attack early while minimizing false positives. Which approach is most effective?

   • AAlert only when the account lockout threshold is reached.
   • BDisable logging for failed attempts to reduce noise.
   • CAlert on a high number of failed authentication attempts from a single IP address within a short time window.
   • DAlert on any failed authentication attempt.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A development team is building a REST API that accepts JSON payloads to update user profiles. A security tester finds that sending a JSON body with a key like "__proto__" can alter the behavior of the application's JavaScript objects. What is the most effective defense?

   • AReject JSON keys that match dangerous prototype properties such as "__proto__" and "constructor"
   • BUse a JSON parser that automatically merges nested objects
   • CRequire clients to send a custom header with a static API key
   • DEncode all JSON responses as base64 before sending to the client
   Reveal Solution Discussion Select an answer first