web Security

Which OWASP resource is crucial for developers to understand and mitigate web security risks?

• OWASP Secure Coding Guidelines

• OWASP Top 10

• OWASP ZAP

• OWASP Defenders

What vulnerability involves unsanitized user input executing unintended commands?

• XSS (Cross-Site Scripting)

• CSRF (Cross-Site Request Forgery)

• SQL Injection

• SSRF (Server-Side Request Forgery)

Which OWASP Top10 involves allowing users to access restricted resources or functionalities outside their assigned role​

• A01:2021– Broken Access Control

• A04:2021–Insecure Design

• A06:2021–Vulnerable and Outdated Components

• A07:2021–Identification and Authentication Failures

Which OWASP Top 10 category does 'using components with known vulnerabilities' fall under?

• A05:2021–Security Misconfiguration

• A08:2021–Software and Data Integrity Failures

• A10:2021–Log4j

• A06:2021–Vulnerable and Outdated Components

What is a primary defense against 'Injection' flaws according to OWASP?

• Client-side validation

• Strong encryption

• Input validation

• Frequent password changes

Which one of the following is NOT a prevention method for OWASP top 10 'Identification and Authentication Failures'

• Implementing multi-authentication​

• Using default usernames and passwords

• Aligning password policies with the latest NIST standards

• report failed login attempts and notify administrators of possible attacks.

For 'Identification and Authentication Failures' which standard does OWASP recommend aligning password policies with?

• IEEE 802.11

• ISO/IEC 27001

• NIST

• OWASP itself

How does OWASP suggest handling 'Server-Side Request Forgery (SSRF)' at the application layer?

• Increase logging detail

• Use network segmentation

• Validate all client-supplied input data

• Disable server-side caching