Web Services Security GWEB Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is migrating from a SOAP-based web service to a REST API. The security team wants to ensure that the new API has comparable security controls. Which consideration is unique to REST APIs compared to SOAP?

   • AREST APIs often rely on HTTP methods and status codes, which can be abused if not properly restricted.
   • BREST APIs cannot use authentication tokens.
   • CSOAP requires TLS for all communications, while REST does not.
   • DSOAP has built-in rate limiting, while REST requires external tools.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a primary security weakness of using static API keys for authentication?

   • AThey cannot be revoked.
   • BThey are easily guessed because they are short.
   • CThey are long-lived and often lack expiration, so if leaked they remain valid indefinitely.
   • DThey are sent in the URL query string, which can be logged.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which OWASP API Security Top 10 risk is most directly related to excessive data exposure?

   • ABroken Object Level Authorization (BOLA)
   • BSecurity Misconfiguration
   • CInjection
   • DExcessive Data Exposure
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A penetration tester is assessing a SOAP service that uses XML signatures. The tester discovers that by moving a signed element to a different part of the document, the signature remains valid. The service processes the moved element as if it were the original. Which mitigation is most effective?

   • ADisable DTD processing in the XML parser.
   • BEncode the XML payload in base64 before transmission.
   • CValidate that the signed element is in the expected location within the document structure.
   • DUse a longer XML signature key.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security tester is performing a penetration test on a REST API. They want to identify all endpoints and understand the data structure without causing damage. Which approach is most effective?

   • ARun an automated vulnerability scanner with aggressive payloads against all endpoints
   • BIntercept traffic from a production client to map the API
   • CFuzz every parameter with random data without any prior knowledge
   • DReview the API documentation and then send controlled test requests to each endpoint with valid and invalid inputs
   Reveal Solution Discussion Select an answer first