Web Services Security GWEB Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A security analyst is comparing the attack surfaces of SOAP and REST web services. Which statement accurately describes a core difference in their security challenges?

   • AREST services typically use XML exclusively, making them immune to JSON injection.
   • BSOAP services rely on JSON payloads, which are more prone to XXE attacks than XML.
   • CSOAP services often have a formal contract (WSDL) that can expose operations, while REST services rely on HTTP methods and URLs, which may expose endpoints through documentation or discovery.
   • DREST services are always stateless, so they have no session-related security concerns.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company is implementing OAuth 2.0 for a third-party application that needs to access a user's calendar on behalf of the user. The application will run on a mobile device. Which OAuth 2.0 grant type is most appropriate?

   • AAuthorization Code with PKCE
   • BImplicit Grant
   • CClient Credentials
   • DResource Owner Password Credentials
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of fuzzing a web service?

   • ATo send malformed or unexpected input to discover crashes, errors, or vulnerabilities.
   • BTo verify that the service meets functional requirements.
   • CTo check the service's compliance with accessibility standards.
   • DTo test the service's performance under high load.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A QA engineer is testing a SOAP web service for input validation issues. The service accepts an XML document that includes a date field. The engineer wants to test how the service handles malformed dates and unexpected XML structures. Which testing technique is most appropriate?

   • AManually testing a few known valid dates.
   • BRunning a vulnerability scanner that only checks for known CVEs.
   • CFuzzing the XML payload with random and malformed date values and structural variations.
   • DReviewing the WSDL to ensure the service contract is correct.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A web service's TLS certificate is about to expire. What is the most likely security impact if the certificate is not renewed?

   • AThe service will automatically switch to plain HTTP.
   • BThe service will become vulnerable to SQL injection.
   • CThe server will stop encrypting data, but the connection will still work.
   • DClients will receive warnings and may be unable to establish a trusted connection, leading to service disruption.
   Reveal Solution Discussion Select an answer first