What does setting `SameSite=Strict` on cookies help prevent?

• XSS
• CSRF
• Clickjacking
• CORS issues

Which header protects against Clickjacking attacks?

• Content-Type
• X-Content-Type-Options
• X-Frame-Options
• Cache-Control

In a broken access control test, what’s the best way to discover IDOR?

• XSS injection
• Changing URL parameters
• Clearing cookies
• Changing HTTP method

In OAuth, what is the purpose of the `state` parameter?

• Session tracking
• Scope restriction
• CSRF protection
• Token refresh

You bypass a login by modifying a JWT’s algorithm to `none`. What’s this flaw?

• Key reuse
• Signature validation bypass
• Replay attack
• Session fixation

What does SSRF in a cloud app often lead to?

• XSS
• IAM access
• File upload
• Shellshock

Which AWS service metadata IP is often targeted by SSRF?

• 127.0.0.1
• 0.0.0.0
• 169.254.169.254
• 192.168.1.1

Public S3 bucket lists file names but blocks `GetObject`. Risk?

• Directory traversal
• Sensitive data exposure via filenames
• Stored XSS
• Log injection

Which GCP IAM role has full project-level permissions?

• roles/viewer
• roles/owner
• roles/editor
• roles/admin

An attacker uploads a `web.config` file in a .NET app. What can this do?

• Add an admin user
• Trigger RCE via config override
• SQLi
• CORS bypass