Web application security

Out of the following which one can be considered as a possible solutions for SQL injection vulnerability?

• Input Data Validation

• Secure Cookies

• Encryption

• Exception Handling

Answer explanation

Injections are primarily caused by sending malicious inputs that can break the code or SQL or no-SQL statements while querying from DB or performing a business operation. Hence, proper input validations and sanitizations can keep them checked.

which of the following layers are related to application security in OSI model

• Application layer

• Presentation layer

• Session layer

• All the above

In Cross Site Scripting, the primary target is which of the following ?

• Client (browser)

• Database

• Web server

• Web application

Out of the following which can be considered as user input for which validation is not required

• Host Header

• cookies

• Referrer Header

• None of the above

Which of the following can be stored in the cookie?

• Session ID

• Account privileges

• username

• password

What are the fundamental principles of Security?

• Availability, Integrity, Confidentiality

• Usability, Reliability, Accountability

• Quality, Accountability, Integrity

• All the above

What flaw arises from session tokens having poor randomness across a range of values?

• Insecure Direct Object References

• Session Replay

• Session Fixation

• Session Hijacking

Which attack can execute scripts in the user's browser and is capable of hijacking user sessions, defacing websites, or redirecting the user to malicious sites?

• SQL Injection

• Cross site scripting

• Malware uploading

• man-in-the-middle attack

The attack exploits the trust that a site has in a user's browser.

• Session Hijacking

• Cross Site Request Forgery

• SQL Injection

• Cross Site Scripting

What does “White List” data validation means?

• Data is validated against a list of values that are known to be valid

• Data is validated against a list of values that are known to be invalid

• Accepting all inputs

• None of the above