Font size
WorksheetsWeb Application Security Testing-PreTest
Total questions: 20
Worksheet time: 10mins
Which of the following threats is most likely to be caused by poor input validation?
Enabling of IPSec
Insecure direct object reference
Insufficient transport layer protection
Insecure cryptographic storage
What happens when an application takes user inputted data and sends it to a web browser without proper validation and escaping?
Security Mis-configuration
Cross Site Scripting
Insecure Direct Object Reference
Broken Authentication and Session Management
An attack technique that forces a user’s session credential or session ID to an explicit value
Brute Force Attack
Session Hijacking
Session Fixation
Dictionary Attack
What threat arises from not flagging HTTP cookies with tokens as secure?
Session Hijacking
Insecure Cryptographic Storage
Access Control Violation
Session Replay
How does malicious input flow in a DOM-based XSS?
From Server to Client
From Client to Server
From Attacker to Server
From Victim to Server
Which attack can execute scripts in the user’s browser and is capable of hijacking user sessions, defacing websites or redirecting the user to malicious sites
SQL injection
Cross Site Scripting
Malware Uploading
Man in the Middle
What flaw can lead to exposure of resources or functionality to unintended actors?
Session Fixation
Improper authentication
Insecure Cryptographic Storage
Invalidated redirects and forwards
Role-Based Access control helps prevent this OWASP Top 10 weakness
Failure to restrict URL Access
Invalidated Redirect or Forward
Security Mis-configuration
Insufficient Transport Layer Protection
What is the type of flaw that occurs when un trusted user entered data is sent to the interpreter as part of a query or command?
Insecure Direct Object References
Injection
Cross Site Request Forgery
Insufficient Transport Layer Protection
For every link or form which invoke state-changing functions with an unpredictable token for each user what attack can be prevented?
OS Commanding
Cross-site Scripting
Cross-site Request Forgery
Cross-site tracing
Which of the following consequences is most likely to occur due to an injection attack
Spoofing
Cross-Site request Forgery
Denial Of Service
Insecure Direct Object Reference
Attack that exploits the trust that a site has in a user's browser
Session Hijacking
Cross-Site Request Forgery
SQL injection
Cross-Site Scripting
We can allow client side scripts to execute in the browsers for needed operations
TRUE
FALSE
What is phishing
Data Transfer Protocol
Email Scam
Network Scandal
Cross Domain Scam
You receive an e-mail from bank saying that you have won a contest. What should you do
Provide the information so you can claim your prize as quickly as possible
Answer the e-mail and ask them to call you with more information
Contact your bank to confirm the information
Forward the mail to others for their opinion
The use of proper security techniques can (choose two)
Minimize the threat of attackers
Allow access to unauthorized users
Prevent most hackers from accessing your system
Provide 100 percent security
Network permissions should be established so that users can accomplish their tasks, but cannot access any system resources that are not necessary so that
A hacker cannot steal a legitimate user's identity
Users will not have access to and misuse system resources
Only the resources authorized for that user will be at risk
Hackers will not pose as legitimate users
Which of the following are most often associated with a security misconfiguration threat? (Choose two.)
Unused services
Default accounts
Bad cryptography
Unsafe key storage
For a connection that changes from HTTP to HTTPS, what flaw arises if you do not change the session identifier
Session replay
Cross-Site Scripting
Cross-Site Request Forgery
Session Hijacking
You should set a secure flag in a cookie to ensure that:
The cookie is a persistent cookie
The cookie is sent over an encrypted channel
The cookie is deleted when the user closes the browser
The cookie is not available to client script
