API Testing CTAL-TTA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security tester is evaluating an API that uses OAuth 2.0 with the authorization code flow. The tester discovers that the API does not validate the 'state' parameter. What is the most significant risk associated with this missing validation?

   • AAn attacker can intercept the authorization code and exchange it for an access token.
   • BAn attacker can perform a cross-site request forgery (CSRF) attack on the authorization endpoint.
   • CAn attacker can replay the authorization code to obtain multiple access tokens.
   • DAn attacker can guess the client secret and impersonate the client.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security tester is assessing an API that uses API keys for authentication. The tester notices that the API key is sent as a query parameter in the URL. What is the primary security concern with this practice?

   • AThe API key may be logged in server logs and browser history.
   • BThe API key is not validated by the server.
   • CThe API key is visible to the client only.
   • DThe API key is not encrypted in transit.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a key benefit of automating API tests?

   • AIt requires no maintenance when the API changes
   • BIt guarantees that all defects will be found
   • CIt allows tests to be executed repeatedly and consistently, especially in CI/CD pipelines
   • DIt eliminates the need for manual testing entirely
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When testing API error handling, what should be verified?

   • AThe API returns a 200 OK status for all requests
   • BThe API returns the same response for all error conditions
   • CThe API logs all requests to a file
   • DThe API returns appropriate HTTP status codes and error messages for error conditions
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of testing an API for broken object-level authorization?

   • ATo check that the API documentation is accurate
   • BTo ensure that the API returns the correct status codes for different requests
   • CTo measure the response time of the API under load
   • DTo verify that a user can only access data objects they are authorized to access
   Reveal Solution Discussion Select an answer first