Font size
S
M
L
XL
Worksheets305 - P2 - SAS12,13
Total questions: 28
Worksheet time: 28mins
Name
Class
Date
1.
XSS stands for (a)
2.
CSP stands for (a)
3.
It is a type injection attack
a)
XSS
b)
CSP
4.
The hacker aims to execute malicious scripts in a web browser of the victim by putting malicious code in a legitimate web page or web application
a)
XSS
b)
CSP
5.
It is a common attack vector that injects malicious code into a vulnerable web application
a)
XSS
b)
CSP
6.
Cross-Site Scripting Attacks can be broken down into two types:
*Input both answers separated by a single space
(a)
7.
A webpage or web application is vulnerable to ______ if it uses unfiltered user input in the output that it generates.
a)
XSS
b)
CSP
8.
Its attacks are possible in VBScript, ActiveX, Flash and even CSS. However, they are most common in JavaScript.
a)
XSS
b)
CSP
9.
It has a special kind of header in their website which is quite straightforward, and there are only a few things you need to understand.
a)
XSS
b)
CSP
10.
It has a special kind of header in their website which is quite straightforward, and there are only a few things you need to understand.
a)
XSS
b)
CSP
11.
It is a security standard that provides an additional layer of protection from cross-site scripting (XSS), clickjacking and other code injection attacks.
a)
XSS
b)
CSP
12.
IMPORTANCE OF CONTENT SECURITY POLICY (CSP)
a)
1. Mitigating Cross-site scripting
b)
2. Mitigating Packet sniffing and enforcing HTTPS
13.
The (a) is made up of directives separated with a semicolon.
14.
It occurs when a malicious script is injected directly into a vulnerable web application.
a)
STORED XSS
b)
REFLECTED XSS
15.
It is more damaging, also known as the Persistent XSS
a)
STORED XSS
b)
REFLECTED XSS
16.
It involves the reflecting of a malicious script off of a web application onto a user’s browser.
a)
STORED XSS
b)
REFLECTED XSS
17.
The code is embedded
a)
STORED XSS
b)
REFLECTED XSS
18.
This acts as a catchall for everything
a)
DEFAULT-SRC
b)
SCRIPT-SRC
c)
STYLE-SRC
19.
Describes where we can load JavaScript files from
a)
DEFAULT-SRC
b)
SCRIPT-SRC
c)
STYLE-SRC
20.
Describes where we can load Stylesheets from
a)
DEFAULT-SRC
b)
SCRIPT-SRC
c)
STYLE-SRC
21.
Describes where we can load images from
a)
IMG-SRC
b)
CONNECT-SRC
c)
FONT-SRC
22.
Applies to AJAX and WebSocket
a)
IMG-SRC
b)
CONNECT-SRC
c)
FONT-SRC
23.
Describes where we can load fonts from
a)
IMG-SRC
b)
CONNECT-SRC
c)
FONT-SRC
24.
Describes where we can load objects usually
a)
OBJECTS-SRC
b)
MEDIA-SRC
c)
FRAME-ANCESTORS
25.
Describes where we can load audio and video files from
a)
OBJECTS-SRC
b)
MEDIA-SRC
c)
FRAME-ANCESTORS
26.
Describe which sites can load this site in an iFrame
a)
OBJECTS-SRC
b)
MEDIA-SRC
c)
FRAME-ANCESTORS
27.
Enumerate the first five (1-5)
CROSS-SITE SCRIPT DIRECTIVES:
clue: DS SS SS IS CS
*input in single line separate them with single spaces
(a)
28.
Enumerate the last four (6-9)
CROSS-SITE SCRIPT DIRECTIVES:
clue: FS OS MS FA
*input in single line separate them with single spaces
(a)
Reset
