Web Security Quiz

What is the term used for injecting JavaScript into a user's web browser through page elements like comment sections, search results, and URLs?

• Cross-Site Request Forgery

• SQL Injection

• Cross-Site Scripting

• Phishing

What vulnerability do attackers exploit to steal Gmail contact lists, trigger one-click purchases on Amazon, and change router configuration?

• Phishing

• Cross-Site Request Forgery

• SQL Injection

• Cross-Site Scripting

What design philosophy, recommends using GET requests only to fetch web pages or other resources?

• SOAP

• REST

• GraphQL

• RPC

What is the purpose of anti-CSRF cookies in protecting against CSRF attacks?

• To validate HTTP requests made from JavaScript

• To ensure that GET requests originate from the same domain

• To force reauthentication for sensitive actions

• To strip cookies on requests generated from external domains

What attribute is specified when setting cookies to strip cookies on requests generated from external domains?

• SameSite

• Secure

• Path

• HttpOnly

What is the purpose of setting the SameSite attribute to Lax for cookies?

• To prevent cookies from being accessed by JavaScript

• To force reauthentication for sensitive actions

• To alow sending of cookies from some cross site requests

• To ensure cookies are sent only with requests initiated from within the same site

What is the benefit of requiring reauthentication for sensitive actions on a website?

• To improve user experience

• To alow seamless linking into the site

• To add an additional layer of protection against CSRF attacks

• To protect against cross-site scripting attacks

What is the primary solution to protect against cross-site request forgery attacks?

• Using secure passwords

• Requiring reauthentication for all actions

• Defusing GET requests and using anti-CSRF cookies

• Implementing anti-virus software

What is the primary vulnerability that attackers exploit in cross-site request forgery attacks?

• Vulnerable server software

• Weak encryption algorithms

• GET requests that changes server state

• Insecure network protocols

What is the purpose of using anti-CSRF cookies to validate HTTP requests made from JavaScript?

• To ensure that GET requests originate from the same domain

• To protect against requests using other HTTP verbs

• To strip cookies on requests generated from external domains

• To verify that POST requests originate from pages hosted on the same web domain