Font size
WorksheetsWeb Application Security Testing-PostTest
Total questions: 18
Worksheet time: 9mins
What happens when an application takes user inputted data and sends it to a web browser without proper validation and escaping
Security Mis-configuration
Cross Site Scripting
Insecure Direct Object References
Broken Authentication and Session Management
Which character is most likely to be used for an SQL injection attack
Single quote (')
Null (\0) byte
Less than sign(<)
Greater than sign(>)
Which of the following attacks occurs when a malicious user convinces a victim to send a request to a server with malicious input and the server echoes the input back to client?
Reflected XSS
Persistent XSS
Insecure Direct Object Reference
Failure to Restrict URLs
An attack technique that forces a user’s session credential or session ID to an explicit value.
Brute Force Attack
Session hijacking
Session Fixation
Dictionary attack
Which of the following is the best way to ensure that JavaScript cannot be used to access a cookie
Set the Secure Flag in the Cookie
Set the HTTP only Flag in the Cookie
Use the CAPTCHA System
Use non-persistent cookie
What threat arises from not flagging HTTP cookies with tokens as secure
Session Hijacking
Insecure Cryptographic Storage
Access Control Violation
Session replay
Which attack can execute scripts in the user’s browser and is capable of hijacking user sessions, defacing websites or redirecting the user to malicious sites
SQL injection
Cross-Site Scripting
Malware Uploading
Man In The Middle Attack
Why should you use CAPTCHA
To create cryptographically random session IDs
To protect credentials by using encryption or cryptographic salt and hash
To protect authentication systems from automated or brute-force attacks
To ensure that authentication systems implement inactivity timeout functionality
What flaw can lead to exposure of resources or functionality to unintended actors
Session Fixation
Improper Authentication
Insecure Cryptographic Storage
Invalidated Redirects and Forwards
Role-Based Access control helps prevent this OWASP Top 10 weakness
Failure to restrict URL Access
Invalidated Redirect or Forward
Security Mis-configuration
Insufficient Transport Layer Protection
What is the type of flaw that occurs when untrusted user entered data is sent to the interpreter as part of a query or command
Insecure Direct Object References
Injection
Cross Site Request Forgery
insufficient Transport Layer Protection
Which threat is most likely to occur when a POST parameter performs an operation on behalf of a user without checking a shared secret
Cross Site Request Forgery
Insecure Direct Object Reference
Cross Site Scripting
Injection
Which of the following is most likely to result from invalidated redirects and forwards
Brute Force Attack
Network Sniffing
Man In The Middle Attack
Bypassed Authorization attack
Attack that exploits the trust that a site has in a user's browser
Session Hijacking
Cross Site request Forgery
SQL injection
Cross Site Scripting
Which of the following functionalities should you include in an authentication and session management system? (Choose two.)
Logout Functionality
Inactivity Time-out functionality
Escaping Functionality
Forwarding System Functionality
What is phishing
Data transfer Protocol
Email Scam
Network Scandal
Cross Domain Scam
Which of the following are most often associated with a security mis-configuration threat
Unused Service
Default Accounts
Bad Cryptography
Unsafe Key Storage
You should set a secure flag in a cookie to ensure that
The cookie is a persistent cookie
The cookie is sent over an encrypted channel
The cookie is deleted when the user closes the browser
The cookie is not available to client script
