Web Services Security GWEB Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An API uses JWT bearer tokens for authentication. A security review finds that the server does not verify the token's signature. What is the most likely impact?

   • AAn attacker can forge a token with arbitrary claims and impersonate any user
   • BThe token will be rejected by the client
   • CThe token will be encrypted in transit
   • DThe token will expire immediately
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A REST API accepts a JSON object to create a new user. The API currently trusts the client-supplied "role" field. A penetration test reveals that an attacker can set "role":"admin" and gain elevated privileges. What is the most effective fix?

   • AValidate that the "role" field contains only alphanumeric characters
   • BLog the "role" field for auditing purposes
   • CRemove the "role" field from the client request and assign it server-side based on the authenticated user
   • DEncode the "role" field in the JSON response
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is deploying a web service that will be accessed by clients in multiple countries. The service will handle personal data subject to GDPR. The security team wants to ensure data in transit is protected and that the server's identity is verified. Which configuration is most appropriate?

   • AUse a self-signed certificate and rely on certificate pinning in the client application.
   • BUse TLS with a certificate from a trusted CA and enforce HTTPS-only connections.
   • CUse TLS but disable certificate validation to avoid compatibility issues.
   • DEncrypt the payload with a shared key and send it over HTTP.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A healthcare organization is deploying a REST API that transmits patient data. They must ensure data confidentiality and integrity between clients and the API. The API will be accessed over the public internet. What is the minimum required configuration?

   • AEnable TLS 1.2 or higher with a valid certificate from a trusted CA
   • BUse a self-signed certificate on the server
   • CEncrypt the payloads with AES before sending over HTTP
   • DRely on the API key to protect the data
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security team is investigating a potential account takeover attack on a REST API. They have logs that show many failed login attempts from different IP addresses, but all using the same user agent and a similar password pattern. What is the most likely attack and what log data would help confirm it?

   • ABrute-force attack; log the password hash of each attempt
   • BCredential stuffing; log the username, source IP, timestamp, and the result of each attempt
   • CDistributed denial of service; log the request size and response time
   • DAPI key leakage; log the API key used in each request
   Reveal Solution Discussion Select an answer first