GCIH Web App API Attacks Practice Test 2 — 15 Questions

Question 1

An incident responder is investigating a modern web application and notices that users can modify object identifiers in REST API endpoints to access sensitive records belonging to other tenants. Which primary vulnerability category does this represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization occurs when an application fails to properly verify user permissions before granting access to objects based on the provided identifier. Attackers manipulate the ID parameter to view or modify unauthorized data, making this a critical Web App API security flaw requiring strict role-based checks.

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Answer

Mass Assignment Vulnerability

Question 2

An incident responder is investigating a modern web application and notices that users can modify object identifiers in REST API endpoints to access sensitive records belonging to other tenants. Which primary vulnerability category does this represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insecure Direct Object Reference. This scenario describes an Insecure Direct Object Reference vulnerability, commonly classified under Broken Object Level Authorization in modern API security taxonomies. The application fails to validate whether the requesting user possesses authorization to access the specific resource identifier requested in the URL path. Attackers systematically enumerate these predictable identifiers to harvest unauthorized sensitive data across multi-tenant API endpoints during security assessments and active breaches.

Answer

Broken Function Level Authorization

Answer

Cross-Site Request Forgery

Answer

Server-Side Request Forgery

Question 3

During a penetration test of a GraphQL API, an incident handler finds that the introspection system is enabled and can be queried without authentication. The handler retrieves the full schema, including hidden fields and mutations. What is the most significant security impact of this finding?

Accepted Answer

Attackers can map the entire API surface, identify sensitive fields and mutations, and craft targeted queries to abuse them.. Exposed GraphQL introspection lets attackers retrieve the full schema, including hidden fields and mutations. This information disclosure enables them to craft precise queries and mutations that target sensitive operations, significantly lowering the effort required for further exploitation. The other options either misstate the technical effect or focus on less likely outcomes. Therefore, schema mapping and targeted abuse is the most significant impact.

Answer

Attackers can directly execute arbitrary code on the GraphQL server through introspection queries.

Answer

Attackers can bypass authentication by sending a specially crafted introspection query that returns valid session tokens.

Answer

Attackers can cause a denial of service by sending an introspection query that recursively expands the schema indefinitely.

Question 4

An incident responder is analyzing a web application that uses a REST API. The API accepts a 'file' parameter that specifies a URL from which to fetch an image. The responder observes that an attacker supplied a URL pointing to an internal metadata service (e.g., http://169.254.169.254/latest/meta-data/) and successfully retrieved sensitive instance credentials. Which vulnerability class does this represent?

Accepted Answer

Server-Side Request Forgery (SSRF). The server fetched a user-supplied URL, which pointed to an internal metadata service, and returned sensitive credentials. This is a Server-Side Request Forgery (SSRF) attack, where the attacker abuses the server's ability to make requests to internal resources. The other options describe different attack vectors that do not involve the server making arbitrary outbound requests based on user input. SSRF is the correct classification.

Answer

Insecure Direct Object Reference (IDOR)

Answer

Cross-Site Request Forgery (CSRF)

Answer

XML External Entity (XXE) injection

Question 5

A GCIH incident handler is reviewing web server logs after a suspected API reconnaissance campaign. The logs show numerous requests to endpoints such as /api/v1/users, /api/v2/users, /api/v3/users, and /api/internal/users, all returning HTTP 404 except one. Which attack technique is most consistent with this pattern?

Accepted Answer

API version enumeration. The pattern of requests to multiple API version prefixes and internal-looking paths, with only one returning a non-404 response, indicates deliberate version and endpoint enumeration. Attackers use this to map the API surface and find versions that may be deprecated, unpatched, or less protected, which then become targets for further exploitation.

Answer

Cross-site scripting (XSS) in API responses

Answer

Server-side request forgery (SSRF) via API parameters

Answer

JWT algorithm confusion attack

Question 6

A security analyst is reviewing logs from a web application firewall (WAF) and notices a series of requests containing payloads like ' OR 1=1 --' and 'UNION SELECT username, password FROM users'. These requests are targeting the login endpoint. Which type of attack is being attempted?

Accepted Answer

SQL Injection (SQLi). The payloads contain SQL keywords and syntax designed to alter database queries, such as bypassing authentication or extracting data via UNION. This is characteristic of SQL injection. The other options represent different attack categories: XSS targets client-side scripts, command injection targets OS commands, and CSRF targets user browsers. The evidence clearly points to SQL injection.

Answer

Cross-Site Request Forgery (CSRF)

Answer

Cross-Site Scripting (XSS)

Answer

Command Injection

Question 7

During an incident response engagement, a GCIH analyst examines an API that accepts JSON input and notices that the application returns detailed database error messages when a single quote is inserted into the 'username' field. The analyst also observes that the same endpoint returns a 500 error when a specially crafted JSON object with nested arrays is submitted. Which vulnerability class is the analyst most likely investigating?

Accepted Answer

Injection flaws, such as SQL injection and improper input validation. The combination of database error messages in response to a single quote and a 500 error from malformed nested JSON indicates that the application is not properly validating or sanitizing input before passing it to backend interpreters. This is a classic sign of injection flaws, which can lead to data compromise or remote code execution.

Answer

Insecure direct object references (IDOR)

Answer

Excessive data exposure in API responses

Answer

Broken authentication via weak API keys

Question 8

An incident handler reviews web server logs from an e-commerce application and finds a burst of requests where the JSON body of a POST to /api/v2/orders/checkout contains a deeply nested object several thousand levels deep, causing the backend deserializer to exhaust CPU and memory until the worker crashes. The application accepts arbitrary JSON and binds it directly to internal model objects. Which vulnerability class best describes this attack?

Accepted Answer

Unsafe deserialization of untrusted JSON input. The crash is caused by the deserializer recursively building an extremely deep object graph from attacker-supplied JSON, exhausting CPU and memory. When an API binds untrusted JSON directly to internal models without enforcing maximum depth, size, or allowed-property rules, the parsing stage itself becomes the attack surface. Incident handlers should correlate the crash with payload structure, then recommend depth limits, schema validation, and safe parser configuration.

Answer

Mass assignment through the checkout JSON binding

Answer

Injection through unvalidated JSON string values

Answer

Server-side request forgery triggered by the checkout payload

Question 9

A GCIH incident responder is investigating a suspected API attack where an attacker manipulated a JSON Web Token (JWT) to gain unauthorized access. The responder needs to identify which two conditions would allow a JWT 'kid' (Key ID) header injection attack to succeed. (Choose two.)

Accepted Answer

The application allows the 'kid' header to specify an absolute path or URL that the server will fetch to obtain the key.. JWT 'kid' injection succeeds when the application uses the 'kid' header to determine the verification key without validating its content. If the 'kid' is used to build a file path or fetch a remote key, an attacker can manipulate it to use a key they control, forging valid tokens. The other conditions describe different JWT weaknesses.

Answer

The application uses a symmetric signing algorithm and the secret is weak or guessable.

Answer

The JWT is transmitted over an unencrypted HTTP connection, allowing token interception.

Answer

The application supports the 'none' algorithm and accepts unsigned tokens.

Question 10

A GCIH analyst is called after a SaaS provider reports that an integration partner's API traffic began returning other tenants' records. The partner's client was calling /api/v3/documents/{documentId} and had recently started sending a second header, X-Tenant-Id, that the gateway trusts to route requests. The analyst confirms the partner is authenticated with a valid OAuth 2.0 bearer token scoped to its own tenant. Which weakness allowed the cross-tenant exposure?

Accepted Answer

The API trusted a client-supplied header for tenant routing instead of deriving tenant scope from the authenticated token claims. The gateway trusted an attacker-controllable header to decide which tenant's data to return while authorization relied solely on the caller's own bearer token. Because tenant selection and authorization were decoupled, any authenticated caller could request another tenant's documents by naming that tenant in the header. The fix is to derive tenant scope from verified token claims or server-side state and ignore client-supplied routing headers for authorization decisions.

Answer

The document IDs were sequential integers, allowing enumeration of other tenants' records by incrementing the identifier

Answer

The OAuth 2.0 bearer token was forged because the partner guessed the signing key used by the authorization server

Answer

The integration partner exploited a race condition in the API's caching layer to retrieve stale responses belonging to other tenants

Question 11

A GCIH analyst is examining a web application that uses GraphQL. The analyst notices that an attacker sent a deeply nested query that caused the server to consume excessive resources, leading to a denial of service. Which GraphQL-specific vulnerability is being exploited?

Accepted Answer

GraphQL query depth attack. GraphQL's flexible query language allows clients to specify nested fields. Without proper limits, an attacker can send a query with excessive depth, causing the server to recursively resolve many levels and exhaust CPU or memory. This is a query depth attack, a common GraphQL-specific denial-of-service vector.

Answer

GraphQL alias overloading

Answer

GraphQL batching attack

Answer

GraphQL introspection abuse

Question 12

A GCIH candidate is reviewing a REST API that accepts XML in an upload endpoint used for importing supplier catalogs. During a purple-team exercise, testers want to demonstrate how XML-specific parser weaknesses could be abused against this endpoint. Which two techniques should the testers attempt to validate the parser's defenses? (Choose two.)

Accepted Answer

Submit an XML document with an entity definition that recursively references itself to test for exponential entity expansion. Both selected techniques exercise the XML parser itself rather than the surrounding application logic. External entity declarations reveal whether the parser resolves references to local files or network resources, while recursive entity definitions reveal whether expansion is bounded. Together they validate the two most impactful XML-specific defenses for an endpoint that must accept documents from untrusted suppliers.

Answer

Upload an oversized multipart file to exhaust disk space on the API host

Answer

Inject a SQL UNION statement into the catalog name field to test database query construction

Answer

Send a JSON body with a million nested arrays to the same endpoint to test depth limits

Question 13

A SOC analyst triages an alert showing that a mobile banking API responded to a request for /api/accounts/8842/transactions with HTTP 200 and another customer's transaction list. The requesting user was authenticated normally with a valid session token, but the account number in the URL belonged to a different customer. The API returned data without checking whether the authenticated user owned that account. Which vulnerability does this represent?

Accepted Answer

Broken object level authorization on the account resource. The caller was properly authenticated, but the API failed to confirm that the authenticated identity owned the account referenced in the URL. Authorization must be evaluated per object on every request, comparing the resource's owner against the caller's identity. Relying on a valid session alone creates exactly this exposure, where changing an identifier yields another customer's data.

Answer

Cross-site request forgery against the transactions endpoint

Answer

Server-side request forgery through the account identifier parameter

Answer

Insecure direct object reference in the session token generation

Question 14

An incident responder is examining a GraphQL API after a breach report. Query logs show a single POST to /graphql containing a query that requests a user's profile, that user's friends, each friend's friends, and so on through deeply chained relationship fields, all in one request. The response was several megabytes and the database showed a spike in joins. No authentication bypass occurred. Which attack does this describe?

Accepted Answer

A resource-exhaustion query exploiting unbounded nesting of relationship fields. The request abused GraphQL's ability to traverse arbitrarily deep relationships in a single query, forcing the server to resolve a huge graph of related records and return a multi-megabyte response. Because the caller was authenticated, the weakness is missing query cost controls rather than an authentication flaw. Defenders should enforce depth limits, complexity scoring, pagination caps, and timeouts on the GraphQL layer.

Answer

A batched query attack using aliases to replay the same mutation many times

Answer

A server-side request forgery via a GraphQL resolver that fetches remote URLs

Answer

GraphQL introspection abuse to map the schema

Question 15

During an incident involving a single-page application, a handler inspects a GraphQL endpoint at /graphql used for a customer portal. The handler captures a query that requests only the fields needed for a profile view, but the server response includes additional fields such as internalAccountTier, billingNotes, and ssnLastFour. The application uses a single shared GraphQL schema and no field-level authorization middleware. Which GraphQL-specific weakness is most directly demonstrated?

Accepted Answer

Excessive data exposure from over-fetching sensitive fields in the GraphQL response. The response includes sensitive fields that the client did not request, and the server lacks field-level authorization to prevent their serialization. GraphQL resolvers return object properties according to schema and resolver logic, so sensitive data can leak even when the query appears minimal. The handler should focus on excessive data exposure and recommend field-level authorization, schema review, and response filtering.

Answer

GraphQL aliasing used to perform a denial-of-service attack

Answer

GraphQL query batching used to bypass rate limits

Answer

GraphQL introspection enabled on the production endpoint