During an assessment, a penetration tester sends the following request:POST /services/v1/users/create HTTP/1.

This attack attempts to manipulate the API by fuzzing the authorization token (Authorization: Bearer (FUZZ)). This suggests an attempt to bypass authentication or escalate privileges by using an invalid, stolen, or guessed token—a form of API abuse.

Option A (Directory traversal) ❌:

Involves manipulating file paths (e.g., ../../../etc/passwd), but this attack targets API authentication.

Option B (API abuse) ✅:

Correct. Fuzzing the authorization token suggests an attempt to bypass authentication or test for weak API security.

Option C (Server-side request forgery - SSRF) ❌:

SSRF manipulates backend requests to make unauthorized HTTP calls, which is not evident here.

Option D (Privilege escalation) ❌:

While API abuse may lead to privilege escalation, fuzzing the token alone does not directly escalate privileges.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – API Security Testing & Authentication Bypasses