CAS-003 · Question #407
A penetration test is being scoped for a set of web services with API endpoints. The APIs will be hosted on existing web application servers. Some of the new APIs will be available to…
The correct answer is B. Intercepting proxy E. Reconnaissance gathering. For API-focused penetration testing: Reconnaissance gathering (E) is the foundational first step of any engagement - the tester maps the API surface, identifies endpoints, discovers authentication mechanisms, and understands the target before attacking. An intercepting proxy…
Question
A penetration test is being scoped for a set of web services with API endpoints. The APIs will be hosted on existing web application servers. Some of the new APIs will be available to unauthenticated users, but some will only be available to authenticated users. Which of the following tools or activities would the penetration tester MOST likely use or do during the engagement? (Select TWO.)
Options
- AStatic code analyzer
- BIntercepting proxy
- CPort scanner
- DReverse engineering
- EReconnaissance gathering
- FUser acceptance testing
How the community answered
(29 responses)- A3% (1)
- B76% (22)
- C10% (3)
- D7% (2)
- F3% (1)
Explanation
For API-focused penetration testing: Reconnaissance gathering (E) is the foundational first step of any engagement - the tester maps the API surface, identifies endpoints, discovers authentication mechanisms, and understands the target before attacking. An intercepting proxy (B) such as Burp Suite is the primary tool for API testing - it captures and replays HTTP/S requests, allows manipulation of parameters, headers, and authentication tokens, and is essential for testing both authenticated and unauthenticated endpoints. Option A (static code analyzer) requires source code access, which is typically not granted in black-box pen tests. Option C (port scanner) is useful for network-level recon but less targeted for API-specific testing on known hosts. Option D (reverse engineering) applies to binary/compiled software. Option F (user acceptance testing) is a QA activity, not penetration testing.
Topics
Community Discussion
No community discussion yet for this question.