Which of these are examples of "Injection" attacks?

• A bad guy edits high scores on a leaderboard.

• • A website changes colors when you click something.

• • A program sends malicious instructions to the server.

• • Your password stops working.

Answer explanation

• A program sends malicious instructions to the server. Similar to the form example, sending crafted inputs or instructions can manipulate a server's behavior.

What can go wrong with "Broken Access Control"?

• • Someone guesses your password.

• • You can't log into your favorite game.

• • A user can see things they shouldn't.

• • A hacker puts bad code into a website form.

Answer explanation

• A user can see things they shouldn't. Broken access control means not defining who can see or do certain things. This could allow unauthorized viewing of private data.

"Security Misconfiguration" means:

• • A website doesn't protect your data well.

• • A website is poorly built from the start.

• • Your computer has a virus.

• • You forgot to turn off your game console.

Answer explanation

• A website doesn't protect your data well. This is a key element of security misconfiguration. It could lead to data being exposed or modified.

Which of these are problems with "Insecure Design"?

• • A website has old, un-updated software.

• • Security isn't thought about enough.

• • Users don't pick strong passwords

• • Websites have lots of bugs.

Answer explanation

• Security isn't thought about enough. Security needs to be considered as part of the design process, not as an afterthought.

What could be a result of "Sensitive Data Exposure"?

• • An attacker stealing information from a website.

• • Your friend seeing your birthday.

• • Your bank account information being leaked.

• A website forgetting what level you were in a game.

Answer explanation

• Your bank account information being leaked. Financial data is a primary target for attackers and should be heavily protected.

Which actions could be harmful due to "XML External Entities (XXE)"?

• • Opening a document from an unknown source.

• • Your game crashing unexpectedly.

• • Someone finding your private photos online.

• • Using a USB drive you found.

Answer explanation

• Opening a document from an unknown source. XXE attacks can exploit how XML documents are processed, so opening untrusted files is dangerous.

What can happen when using "Components with Known Vulnerabilities"?

• • Your computer runs slower.

• • Websites don't load right.

• • You get more pop-up ads.

• • Hackers can exploit weaknesses in the software.

Answer explanation

• Hackers can exploit weaknesses in the software. The heart of this OWASP category is using components (libraries, frameworks) that have known vulnerabilities, leaving you open to attack.

"Insufficient Logging & Monitoring" can lead to:

• • Not knowing when bad guys are on a website.

• • Your save file in a game getting lost.

• • Websites being slower than usual.

• • Having trouble changing your username.

Answer explanation

• Not knowing when bad guys are on a website. Without proper logging and monitoring, malicious activity may go undetected, allowing attackers more time to operate.

What does "Insecure Deserialization" involve?

• • Bad guys sending sneaky data to a program.

• • Sending a message to your friend.

• • Putting information on a website.

• • Getting hacked because your password is too easy.

Answer explanation

• Bad guys sending sneaky data to a program. Insecure deserialization involves an attacker manipulating serialized data (often objects) to change the program's behavior.

What kind of attack is "Server-Side Request Forgery (SSRF)"?

• • A. Hackers tricking a server into doing something bad.

• • B. Your web browser getting stuck

Answer explanation

• A. Hackers tricking a server into doing something bad. SSRF attacks can make servers perform actions they’re not intended to, resulting in harm.