What does CVE stand for?

• Common Viabilities and Exposures

• Common Vulnerabilities and Exposures

• Common Vulnerabilities and Exploits

• Common Viabilities and Exploits

An attacker impersonates an employee from the IT department and asks a user for her password. He is attempting...

• IP spoofing

• man-in-the-middle attack

• social engineering

• LDAP injection

A spider is used to...

• download copies of websites and their contents

• intercept traffic between the browser and websites

• steal session cookies from other logged-in users

• automate XSS attacks against websites

Which is most likely to occur when the difference between code and data is not clear?

• insecure direct object reference

• security misconfiguration

• broken authentication and session management

• injection

The self-retweeting tweet attack shown is a type of...

• stored XSS

• reflected XSS

• DOM-based XSS

• IDOR

What is likely to happen when a server takes user inputted data and sends it to a browser without proper validation?

• security misconfiguration

• cross-site scripting

• insecure direct object reference

• broken authentication and session management

Which type of XSS attack executes in the browsers of every visitor of a page?

• stored

• reflected

• DOM-based

• man-in-the-middle

 The Secure flag in a cookie ensures that...

• the cookie is a persistent cookie

• the cookie expires when the session ends

• the cookie is sent over an encrypted channel

• the cookie is not available to client script

This attack technique forces a user’s session credential or session ID to an explicit value.

• brute force

• dictionary attack

• session fixation

• session sidejacking

Zap and Burp Suite are examples of...

• payloads

• network sniffers

• password crackers

• proxies