A penetration test is being scoped for a set of web services with API endpoints. The APIs will be hosted on existing web application servers. Some of the new APIs will be available to unauthenticated users, but some will only be available to authenticated users. Which of the following tools or activities would the penetration tester MOST likely use or do during the engagement? (Select TWO.)
A) Static code analyzer
B) Intercepting proxy
C) Port scanner
D) Reverse engineering
E) Reconnaissance gathering
F) User acceptance testing

Question

Quizplus · Accepted Answer

An intercepting proxy is used to analyze and manipulate API requests and responses, which is crucial for testing both authenticated and unauthenticated endpoints. Reconnaissance gathering helps in understanding the API structure, endpoints, and potential vulnerabilities before deeper testing.

A Penetration Test Is Being Scoped for a Set of Web