CS0-003 Vulnerability Management Practice Question
A security analyst is performing an API vulnerability test using OWASP ZAP. The analyst finds several issues. Which THREE of the following are common API vulnerabilities according to OWASP? (Select THREE.)
⚠ Common exam trap
CS0-004 often tests whether candidates can distinguish the OWASP API Security Top 10 from the classic OWASP Top 10 web application list — SQL Injection and XSS are web-app categories, not API-specific ones, so candidates who select them lose the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Broken Object Level Authorization
Broken Object Level Authorization (A) is correct because it is the #1 item on the OWASP API Security Top 10, occurring when an API fails to verify that the requesting user owns or is authorized to access the specific object referenced by an ID in the request (e.g., /api/users/123), allowing horizontal privilege escalation via IDOR-style attacks. Excessive Data Exposure (B) is correct because it is a recognized OWASP API risk where APIs return full objects with sensitive fields (PII, tokens, internal attributes) and rely on the client to filter, exposing data the consumer should never receive. Broken Authentication (E) is correct because it is a core OWASP API Security Top 10 category covering weak credential handling, missing token validation, improper JWT verification, and absent rate limiting on authentication endpoints. SQL Injection (C) and Cross-Site Scripting (D) are not API-specific OWASP API Top 10 categories; they are classic web application vulnerabilities listed in the OWASP Top 10 for web apps, and while an API could theoretically be affected, they are not among the API-specific vulnerabilities the question asks for.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Broken Object Level Authorization
Why this is correct
Broken Object Level Authorization (BOLA) is the most direct and correct answer because it occurs when an API fails to enforce per-object permissions, allowing an attacker to access, modify, or delete another user's data simply by substituting an object ID in an API request. For example, changing 'GET /api/user/123' to 'GET /api/user/456' can expose another user's private information if the server does not verify that the authenticated principal owns the requested object. This flaw is specifically catalogued as API1:2019 in the OWASP API Top 10 and is a primary focus of API penetration testing.
- ✓
Excessive Data Exposure
Why this is correct
Excessive Data Exposure (API3:2019) is another correct option because it describes APIs that return entire database objects or more fields than the client actually needs, leaving the client-side application to filter the sensitive data. Attackers can then intercept the full responses or simply call the API endpoint directly to harvest extra attributes such as hashed passwords, credit card numbers, or internal business logic. This is distinct from BOLA in that it is an information-disclosure flaw caused by over-fetching, not a missing authorization check on the object itself.
- ✗
SQL Injection
Why it's wrong here
SQL Injection is not the best answer because while it can affect APIs through unsanitized parameters, it is a generic attack technique that applies to any data-driven application and is not unique to API design. The OWASP API Top 10 does not list SQL Injection as a standalone API-specific concern; rather, it falls under broader injection categories that affect web applications equally. In the context of API vulnerability testing, you would specifically look for object-level IDOR issues like BOLA before considering ubiquitous web flaws like SQLi.
- ✗
Cross-Site Scripting (XSS)
Why it's wrong here
Cross-Site Scripting (XSS) is incorrect because it is a client-side vulnerability that requires a user's browser to interpret malicious script, whereas an API is a server-side interface that typically returns raw JSON or XML data. Since APIs do not render HTML and execute JavaScript on the server, XSS is not a direct API vulnerability, and it would only become relevant if the API-powered application reflects content without sanitization. Therefore, placing XSS on an API vulnerability test list would be a misunderstanding of the API attack surface.
- ✓
Broken Authentication
Why this is correct
Broken Authentication (API2:2019) is a correct answer because it encompasses flaws such as weak token generation, improper session validation, and the lack of rate limiting on login endpoints, all of which are directly relevant to API security testing. APIs commonly expose authentication mechanisms and if these are broken, an attacker can compromise user accounts or misuse tokens to gain unauthorized access. It is considered one of the most critical API-specific vulnerabilities, with incidence rates around 20% in OWASP's research.
Go deeper
Related to this question
Learn chapter
API Security Testing and Analysis
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.