Level-3 Cyber Browser

What is the primary purpose of the browser’s rendering engine?

• To fetch data from the server

• To display HTML and CSS content in a formatted manner

• To handle user interactions

• To manage browser cookies

What does the Same-Origin Policy (SOP) restrict?

• Only cookies sharing across websites

• Execution of JavaScript

• Interaction between scripts from different origins

• Browser plugin execution

Which HTTP header is used to specify allowed origins in CORS (Cross-Origin Resource Sharing)?

• Access-Control-Allow-Origin

• Access-Control-Allow-Methods

• Content-Type

• Cache-Control

Which one of the following is an example of a cross-site scripting (XSS) attack?

• User input is displayed on a webpage without validation

• A website restricts cross-origin API requests

• A user is logged out after a session timeout

• HTTPS is enabled for secure communication

What is the function of cookies in web applications?

• To store JavaScript files

• To track and store user session information

• To prevent cross-site attacks

• To speed up web page loading times

Analyze the following HTTP request and identify why CORS would block this request: GET /api/data HTTP/1.1 Host: api.example.com Origin: http://otherexample.com

• Because `Origin` is different from `Host`

• Because the request method is GET

• Because the Access-Control-Allow-Headers is missing

• Because the HTTP version is outdated

An application is vulnerable to XSS because it does not properly escape user input in a form field. Which of the following countermeasures will be most effective?

• Allow all HTML tags but block scripts

• Use HTTPS for all requests

• Encode and validate all user inputs

• Use a strong Content Security Policy (CSP)

If a website is vulnerable to CSRF attacks, what is most likely missing from its defense mechanism?

• Proper input validation

• Cross-origin request sharing policy

• A secure anti-CSRF token mechanism

• Cross-site scripting protection

A session token is sent in the URL in a query parameter, as shown: <a href="http://www.example.com/welcome?token=1234567890">Click Here</a> Why is this a security issue?

• The URL is too long

• Session tokens in URLs can be logged and shared

• The session token is encrypted

• The session token will not work in some browsers

After analyzing the following CORS request, which element is essential for proper functionality? Access-Control-Allow-Origin: http://trustedwebsite.com

• The `Access-Control-Allow-Methods` should allow specific HTTP methods

• The `Content-Type` header should match the accepted formats

• The response must include `Access-Control-Allow-Origin: *`

• The server needs to respond with a valid token for all requests