Web Services Security GWEB Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A REST API accepts JSON data that is later inserted into a SQL database. A tester sends a JSON payload with a string value containing a single quote and SQL keywords. The API returns a database error. What is the most likely vulnerability and the best fix?

   • ASQL injection; use parameterized queries or prepared statements
   • BJSON injection; escape all quotes in the JSON payload
   • CCross-site scripting; encode the response
   • DDenial of service; add rate limiting
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SOAP web service accepts XML documents that are then processed by a legacy system. The team wants to prevent XXE and XML injection while maintaining compatibility with valid documents. What is the best approach?

   • AUse a WAF to block requests containing '<!DOCTYPE'
   • BOnly disable DTDs and allow all other XML features
   • CBase64-encode the XML before processing
   • DUse a strict XML schema (XSD) validation and disable DTDs in the parser
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A REST API accepts JSON payloads to create user profiles. The API is vulnerable to JSON injection because it concatenates user input directly into a JSON string before parsing. Which mitigation is most effective?

   • AUse a regular expression to remove quotes and backslashes from user input.
   • BBase64-encode all user input before including it in the JSON.
   • CValidate that the input contains only alphanumeric characters.
   • DUse a JSON library to construct the payload programmatically instead of string concatenation.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard · select all that apply

   A company is implementing security best practices for a public REST API. The API handles sensitive data and is subject to OWASP API Security Top 10. Which two controls are most important to implement? (Select all that apply.)

   • AUse TLS for all communications to protect data in transit.
   • BDisable rate limiting to avoid blocking legitimate users.
   • CImplement rate limiting to prevent abuse and denial-of-service.
   • DLog all requests, including sensitive data such as passwords and tokens.
   Check answers Discussion Select an answer first
6. 25application · medium

   A security tester is assessing a SOAP service that uses XML signatures to ensure message integrity. The tester finds that by moving a signed element to a different position in the document, the signature remains valid. Which attack is being demonstrated?

   • AXML External Entity (XXE)
   • BXML Signature Wrapping
   • CXPath Injection
   • DXML Injection
   Reveal Solution Discussion Select an answer first