Cyber Unit 3 Review Part 5

What is a session in the context of web applications?

• The time a user is authenticated and interacts with a web application

• The time a user spends on a website without logging in

• The duration of a user's internet connection

• The period when a user downloads files from a server

What happens during a session replay attack?

• An attacker captures the session ID and acts as the user

• An attacker deletes the user's session data

• An attacker sends spam emails to the user

• An attacker changes the user's password

What is the purpose of hashing a password when a user logs into a system?

• To store the password in plaintext

• To compare the hash to the stored hash

• To encrypt the password for email

• To send the password to the user

What does an attacker do in a "pass the hash" attack?

• Encrypts the password

• Captures the hash to gain access

• Changes the password

• Deletes the user account

What is a nonce in the context of defending against replay attacks?

• A type of malware

• A numerical value associated with the packet

• A password

• A firewall setting

How is a common nonce typically generated?

• Randomly from a list of words

• By using a combination of the date and time

• By repeating the same number

• By using a fixed number

What happens to a packet if a replay of the same packet occurs and a nonce is used?

• It is accepted and processed

• It is ignored and logged

• It is discarded once the nonce is checked

• It is sent back to the sender

What is privilege escalation?

• A method to improve user experience

• An exploit that allows a malicious actor to gain access to rights, information, or data they would normally not be able to have

• A way to enhance website performance

• A technique to secure data transmission

What does it mean that HTTP is stateless?

• It remembers user sessions

• It continuously communicates with the site or web application in a request-response cycle

• It stores user data permanently

• It encrypts all data automatically

How can an attacker gain privileges according to the text?

• By using strong passwords

• By manipulating retransmitted data

• By installing antivirus software

• By updating the web application