NEW
Font size
WorksheetsLO1 SR
Total questions: 10
Worksheet time: 5mins
Encrypting data with SSL will not guarantee the safety of a website, because:
This only protects data between the website and user, not the Web application itself.
This approach ignores the security of the software on the network or Web server.
This only protects data transmitted through port 443.
The encryption used by SSL is not strong.
What is another term for DAST?
White box testing.
Black box testing.
Glass box testing.
Gray box testing.
What type of attack target a website’s method of validating the identity of a user?
Authorization.
Authentication
Identity attack.
client-side attack.
Which HTTP method sends data to the server?
GET
POST
PUT
SEND
A hacker enters the following script into the search box or an entry form: <Script>’t
Worked”</Script>. The hacker then clicks the search button and a pop-up window appears stating It Worked. What you conclude from this?
The site is susceptible to buffer overflow
The site is susceptible to SQL injection
The site is susceptible to parameter tampering
The site is susceptible to XSS
In electronic authentication, which of the following controls is effective against cross-site scripting (XSS) vulnerabilities?
Sanitize inputs to make them non executable.
Insert random data into any linked uniform resource locator
Insert random data into a hidden field
Use a per-session shared secret
CSRF stands for
Cross State Request Forgery.
Cross Site Reply Forgery.
Cross Site Request Forgery.
Cross State Reply Forgery.
Select a correct answer on how to protest a website from becoming the victim of CSRF attack.
Insert sequence tokens in to the forms and URLs used in transactions.
Use only post method while sending sensitive data to web server
Don’t set up external verification mechanism.
Restrict checking user authentication.
Which is not considered as a weak authentication?
Allowing single words like names as password.
Allowing multiple login attempt for invalid login.
Keeping birthday as password.
Not allowing users to use the previous password.
What is session hijacking?
It is an attackers steals a web session through session ID of victim
A well-managed session ID is called session hijacking.
Storing the sensitive information in the cookies is called session hijacking.
Displaying the session ID in the browser is called session hijacking
