OWASP Quiz

Which of the following are the best ways to prevent unvalidated redirect and forwards vulnerabilities? (Choose two.)

• Use an allow list, such as table indirection.

• Use client-side validation.

• Allow only relative redirects.

• Use session-based indirection.

Which of the following are the best ways to protect a Web application from unvalidated redirects and forwards? (Choose two.)

• Validate the referrer header

• Use extended validation certificates

• Validate all input from the client

• Disallow requests to unauthorized file types

Which of the following can result in insecure cryptography? (Choose two.)

• Unsalted hash

• Unused services

• Default accounts

• Failure to rotate keys

Which of the following are the best ways to mitigate the threat of an insecure direct object reference attack? (Choose two.)

• Use session-based indirection.

• Use POST parameters instead of GET parameters.

• Perform an access check each time a resource identifier arrives as input.

• Send successful logins to a well-known location instead of automatic redirection.

A session-based system authenticates a user to a Web site to provide access to restricted resources. To increase security in this scenario, an authentication token should meet which of the following requirements? (Choose two.)

• It should identify returning users to the site.

• It should be used as a replacement for a user's credentials.

• It should always use a persistent cookie.

• It should always use a non-persistent cookie.

Which of the following are authentication system mandatory requirements? (Choose three.)

• Strong passwords are required.

• Use a GOTCHA to prevent automated attacks.

• User logout and session inactivity are required.

• Session IDs are only accepted from cookies and parameter variables.

• Credentials are always protected with encryption or cryptographic salting and hashing.

Which of the following functionalities should you include in an authentication and session management system?

• Logout functionality

• Inactivity timeout functionality

• Escaping functionality

• Forwarding system functionality

Which of the following input sources can be directly controlled by a malicious user?

• Window.location

• GET/POST parameters

• Server configuration files

• Ports and network resources

Which of the following architecture-level techniques are the best approaches to prevent attacks based on malicious input? (Choose two.)

• Allow list

• Table indirection

• Escaping

• Object class for user input

Which of the following are most vulnerable to injection attacks? (Choose two.)

• Session IDs

• Registry keys

• Regular expressions

• SQL queries based on user input