Font size
S
M
L
XL
WorksheetsSNS_Final
Total questions: 200
Worksheet time: 1hrs 7mins
Name
Class
Date
1.
What does HTTP stand for?
a)
Hypertext Transmission Protocol
b)
Hypertext Transfer Protocol
c)
Hypertext Transfer Policy
d)
Hypertext Transport Protocol
2.
Which technology enables full-duplex communication between browser and server?
a)
Ajax
b)
WebSocket
c)
HTTP
d)
HTTPS
3.
What is the main difference between GET and POST requests?
a)
The way data is transmitted
b)
Their security features
c)
Their use of cookies
d)
Their interaction with JavaScript
4.
What is the purpose of the Same-Origin Policy?
a)
To allow cross-site communication
b)
To block all HTTP requests
c)
To prevent malicious cross-origin access
d)
To enhance server speed
5.
What is the primary purpose of a secret token in CSRF defense?
a)
To encrypt user data
b)
To verify request origin
c)
To bypass browser security
d)
To authenticate cookies
6.
What is the primary purpose of the SameSite cookie property?
a)
To block third-party requests from sending cookies
b)
To encrypt cookies for secure transmission
c)
To enable cross-domain authentication
d)
To allow faster HTTP responses
7.
What is the main function of cookies in web applications?
a)
Storing server-side data
b)
Maintaining session state on the client
c)
Enhancing webpage aesthetics
d)
Blocking advertisements
8.
What does CORS stand for?
a)
Cross-Origin Request Security
b)
Cross-Origin Resource Sharing
c)
Cross-Origin Request Sharing
d)
Cross-Origin Routing System
9.
What is a fundamental cause of CSRF vulnerability?
a)
Lack of HTTPS encryption
b)
Browser's inability to distinguish request origins
c)
Server misconfiguration
d)
Invalid user sessions
10.
What technique is used to embed JavaScript securely into a webpage?
a)
Inline scripting
b)
External scripting
c)
Sandboxing
d)
File handling
11.
What is the role of a security classification label in Mandatory Access Control (MAC)?
a)
To assign permissions to objects
b)
To encrypt classified data
c)
To define security domains
d)
To enable owner-based permissions
12.
Which HTTP method is commonly exploited in CSRF attacks?
a)
PUT
b)
DELETE
c)
GET
d)
OPTIONS
13.
Which cookie attribute ensures cookies are not sent with cross-site requests?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
14.
What type of XSS attack involves the direct storage of malicious data on a target server?
a)
Reflected XSS
b)
Persistent XSS
c)
DOM-based XSS
d)
Cross-Site Request Forgery (CSRF)
15.
What happens if the secret token in a request is invalid?
a)
The request is denied by the server
b)
The request is flagged for manual review
c)
The session is immediately terminated
d)
The user is logged out of their account
16.
What is the primary disadvantage of Discretionary Access Control (DAC)?
a)
Complexity of rules
b)
Lack of flexibility
c)
Risk of accidental misconfiguration by owners
d)
High administrative overhead
17.
Which command is used to check the ARP cache on a Linux system?
a)
arp -n
b)
ifconfig
c)
netstat -arp
d)
ping
18.
What is the primary function of the Address Resolution Protocol (ARP)?
a)
To encrypt network packets for secure communication
b)
To discover the link layer (MAC) address given an IP address
c)
To establish a TCP connection between devices
d)
To determine the latency between two network nodes
19.
What is the purpose of disabling CSRF countermeasures in the Elgg application for this lab?
a)
To evaluate secure implementation
b)
To simplify server-side operations
c)
To allow successful CSRF attacks for demonstration
d)
To test cross-site authentication
20.
What is the primary goal of Content Security Policy (CSP)?
a)
Enhance user interface
b)
Separate data and code
c)
Secure SQL queries
d)
Encrypt user sessions
21.
Which attribute in cookies is used to prevent them from being sent with cross-site requests?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
22.
What is the purpose of cookies in web applications?
a)
Storing user preferences and session information
b)
Enhancing webpage aesthetics
c)
Blocking advertisements
d)
Transferring files between servers
23.
What is a common outcome of an XSS attack?
a)
Loss of database schema
b)
Execution of server-side scripts
c)
Theft of session cookies
d)
Denial of Service (DoS)
24.
What type of attack involves spoofing ARP messages?
a)
SQL injection
b)
MITM (Man-In-The-Middle) attack
c)
DNS cache poisoning
d)
Buffer overflow
25.
Which approach ensures the separation of data and code to prevent XSS?
a)
Using nonces or hashes
b)
Disabling session cookies
c)
Encoding user inputs
d)
Blocking JavaScript execution
26.
What is the primary focus of access control?
a)
Encrypting data
b)
Preventing unauthorized access to resources
c)
Optimizing network performance
d)
Monitoring user behavior
27.
Which command is used to drop all incoming packets matching a rule in iptables?
a)
iptables -t filter -A INPUT <rule> -j ACCEPT
b)
iptables -t filter -A OUTPUT <rule> -j DROP
c)
iptables -t filter -A INPUT <rule> -j DROP
d)
iptables -t nat -A INPUT <rule> -j DROP
28.
What happens when ARP cache poisoning occurs?
a)
Data packets are encrypted
b)
MAC addresses are mapped incorrectly
c)
IP packets are discarded
d)
The network interface disconnects
29.
What is the primary difference between CSRF and XSS attacks?
a)
CSRF attacks exploit the trust a site has in a user's browser, while XSS attacks exploit the trust a user has in a site.
b)
CSRF attacks are executed on the server-side, whereas XSS attacks are executed on the client-side.
c)
CSRF attacks require user interaction, while XSS attacks do not.
d)
CSRF targets session tokens, while XSS targets cookies.
30.
What role does JavaScript play in forging POST requests?
a)
It enables form submissions automatically without user action
b)
It encrypts the requests sent to the server
c)
It verifies the server's responses
d)
It blocks malicious content from being executed
31.
What is a common method used to prevent CSRF attacks?
a)
Using secret tokens
b)
Implementing CORS policies
c)
Encrypting user data
d)
Limiting cookie lifetime
32.
What is the purpose of a gratuitous ARP packet?
a)
To encrypt data during transmission
b)
To request a MAC address from a target device
c)
To update outdated information in all ARP caches on the network
d)
To establish a secure connection between two hosts
33.
What is the primary disadvantage of Role-Based Access Control (RBAC)?
a)
Complexity in management and implementation
b)
Limited flexibility for dynamic access requirements
c)
Vulnerability to insider threats
d)
Over-reliance on user roles for permissions
34.
Which of the following is a common symptom of an XSS attack?
a)
Denied database access
b)
Altered web page content
c)
Server crash
d)
Unauthorized file download
35.
What is the primary purpose of the ARP cache?
a)
To encrypt ARP requests
b)
To store resolved MAC addresses for reuse
c)
To filter ARP messages
d)
To block spoofed ARP replies
36.
What is the primary role of the Network Interface Card (NIC)?
a)
To store IP addresses
b)
To provide a link between a computer and the network
c)
To resolve domain names
d)
To manage routing tables
37.
What does CSRF stand for?
a)
Cross-Site Request Flooding
b)
Cross-Site Resource Forgery
c)
Cross-Site Request Forgery
d)
Cross-Site Reverse Forgery
38.
Which of the following best describes the function of the `elgg.security.token` variables in a web application?
a)
To execute server-side authentication
b)
To store encrypted passwords
c)
To dynamically assign CSRF tokens in JavaScript
d)
To validate user sessions on third-party sites
39.
What is the risk of using the Referer header for CSRF prevention?
a)
It is not included in all HTTP requests
b)
It can be easily modified by attackers
c)
It reveals browsing history
d)
It conflicts with HTTPS
40.
Which method is used to prevent XSS by replacing `<script>` tags with `<script>`?
a)
Filtering
b)
Encoding
c)
HTML sanitization
d)
Escaping
41.
Which of the following is an example of Role-Based Access Control (RBAC)?
a)
A user explicitly allowing access to a file
b)
Firewall rules blocking traffic
c)
Permissions assigned based on a job function
d)
Labeling files with security levels
42.
Which command can be used to enable IP forwarding on a system?
a)
sysctl net.ipv4.ip_forward=1
b)
sysctl net.ipv4.ip_forward=0
c)
enable-ipv4-forwarding
d)
start ip_forward
43.
What attribute specifies a cookie's security level when transmitted over HTTPS?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
44.
What does the `-P` flag in an `iptables` command set?
a)
Policy for a specific chain
b)
Packet forwarding rules
c)
Priority of rules
d)
Packet type
45.
What is the purpose of the `-m conntrack` option in `iptables`?
a)
To track user login sessions
b)
To track packet connection states
c)
To monitor network performance
d)
To enable packet encryption
46.
What is the primary advantage of using SameSite cookies for web security?
a)
They prevent cross-site request forgery attacks
b)
They enhance cookie encryption
c)
They allow cookies to be sent with all requests
d)
They increase page load speed
47.
What is the primary purpose of using secret tokens in web applications?
a)
To verify request origin
b)
To enhance user interface
c)
To store user preferences
d)
To track user activity
48.
What is the main function of ARP in a computer network?
a)
To encrypt network packets for secure communication
b)
To discover the link layer (MAC) address given an IP address
c)
To establish a TCP connection between devices
d)
To determine the latency between two network nodes
49.
What attribute in cookies controls whether they can be sent with cross-site requests?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
50.
What is the purpose of using secret tokens in web applications?
a)
To encrypt user data
b)
To verify request origin
c)
To bypass browser security
d)
To authenticate cookies
51.
What is the primary disadvantage of Mandatory Access Control (MAC)?
a)
It can be overly restrictive and limit user flexibility
b)
It is easier to implement than other access control models
c)
It provides more freedom for users to set their own permissions
d)
It requires less administrative overhead than DAC
52.
Which of the following statements is true about access control models?
a)
Access control models only apply to physical security.
b)
Discretionary Access Control (DAC) allows users to control access to their own resources.
c)
Mandatory Access Control (MAC) is less secure than Role-Based Access Control (RBAC).
d)
Attribute-Based Access Control (ABAC) does not use user roles for access decisions.
53.
Which of the following cookies are primarily used for maintaining session state on the client?
a)
Session cookies
b)
SameSite cookies
c)
Persistent cookies
d)
Third-party cookies
54.
What technology allows a web page to make requests to a server without refreshing the page?
a)
Ajax
b)
WebSocket
c)
HTTP
d)
HTTPS
55.
What happens if a CSRF attack successfully exploits a user's browser session?
a)
The attacker can perform actions on behalf of the user without their consent.
b)
The user's session is immediately logged out.
c)
The user's browser is redirected to a malicious website.
d)
The user's data is permanently deleted.
56.
What does the `encodeURIComponent()` function do in XSS attacks?
a)
Decoding malicious payloads
b)
Encrypting JavaScript code
c)
Encoding data for HTTP POST requests
d)
Displaying alerts
57.
Which connection states are specified by `--ctstate ESTABLISHED,RELATED`?
a)
New and existing connections
b)
Packets belonging to established or related connections
c)
Packets that have been dropped
d)
Forwarded packets only
58.
What is the purpose of the SameSite cookie attribute?
a)
To block third-party requests from sending cookies
b)
To encrypt cookies for secure transmission
c)
To enable cross-domain authentication
d)
To allow faster HTTP responses
59.
What is the main purpose of the CSRF token in web applications?
a)
To prevent unauthorized requests from other sites
b)
To improve page load speed
c)
To store user preferences
d)
To encrypt user data
60.
Which of the following best describes how cookies are used to enhance user experience on websites?
a)
Storing user preferences and login information
b)
Blocking all third-party advertisements
c)
Increasing the loading speed of images
d)
Encrypting sensitive user data
61.
Which command can be used to reset all rules in the `filter` table in iptables?
a)
iptables -t filter -R
b)
iptables -F
c)
iptables -t nat -F
d)
iptables -t filter -D
62.
What is the purpose of the `--limit-burst` option in `iptables`?
a)
Drops all incoming traffic immediately
b)
Specifies the maximum burst of packets allowed
c)
Specifies the packet priority
d)
Increases the timeout for connections
63.
What is the role of the `HttpOnly` attribute in cookies?
a)
It prevents client-side scripts from accessing the cookies.
b)
It ensures cookies are only sent over secure connections.
c)
It allows cookies to be accessed by JavaScript in the browser.
d)
It specifies the expiration time of the cookies.
64.
What is the primary purpose of ARP cache poisoning in network attacks?
a)
To intercept and redirect network traffic
b)
To enhance network security protocols
c)
To optimize network performance
d)
To establish secure connections between devices
65.
What is the consequence of a CSRF attack successfully executing a request on behalf of a user?
a)
The user unknowingly performs an action they did not intend to
b)
A server error occurs and the request is denied
c)
The user's session is terminated immediately
d)
The user's data is encrypted and secured
66.
Which of the following is a common method to secure web applications against CSRF attacks?
a)
Using secret tokens to verify requests
b)
Allowing any cross-origin request
c)
Ignoring Same-Origin Policy
d)
Disabling cookies for security
67.
What is the role of the `elgg_ts` and `elgg_token` parameters in web applications?
a)
To allow session persistence
b)
To validate legitimate requests and defend against CSRF
c)
To enable faster API responses
d)
To encrypt user credentials
68.
What is the role of the ARP cache in a network?
a)
To store resolved MAC addresses for reuse
b)
To filter ARP messages
c)
To encrypt ARP requests
d)
To block spoofed ARP replies
69.
Which type of attack uses JavaScript to manipulate a user's browser and execute malicious code?
a)
Cross-Site Scripting (XSS)
b)
Cross-Site Request Forgery (CSRF)
c)
Denial of Service (DoS)
d)
Man-in-the-Middle (MITM)
70.
Which of the following cookies is set to block cross-site requests?
a)
Session cookies
b)
SameSite cookies
c)
Persistent cookies
d)
Third-party cookies
71.
Which of the following defines access permissions based on predefined rules and filters?
a)
Discretionary Access Control (DAC)
b)
Mandatory Access Control (MAC)
c)
Rule-Based Access Control
d)
Attribute-Based Access Control (ABAC)
72.
Which command is used to list all rules in the `filter` table without line numbers?
a)
iptables -t filter -L -n
b)
iptables -t nat -L -n
c)
iptables -t nat -L --line-numbers
d)
iptables -t filter -L --line-numbers
73.
What technique is used to track packets connection states in `iptables`?
a)
Connection tracking
b)
Packet filtering
c)
Stateful inspection
d)
Session management
74.
What happens if the attacker successfully performs an ARP cache poisoning attack?
a)
The attacker can intercept and manipulate network traffic
b)
The victim's device will automatically disconnect from the network
c)
The network will become completely secure and unhackable
d)
All devices on the network will stop communicating
75.
Which HTTP method is primarily used for submitting data to be processed to a specified resource?
a)
GET
b)
POST
c)
PUT
d)
DELETE
76.
What does the `-A` flag do in an `iptables` command?
a)
Adds a rule to the specified chain
b)
Removes a rule from the specified chain
c)
Lists all rules in the specified chain
d)
Flushes all rules in the specified chain
77.
What is the purpose of Content Security Policy (CSP) in web applications?
a)
To prevent unauthorized code execution
b)
To enhance webpage loading speed
c)
To enable cross-site communication
d)
To manage user authentication
78.
What is the primary disadvantage of using the Access Control List (ACL) model?
a)
Complexity in managing permissions
b)
High performance overhead
c)
Inflexibility in adapting to changes
d)
Limited scalability for large systems
79.
What is the primary function of the Network Interface Card (NIC) in a computer network?
a)
To store IP addresses
b)
To provide a link between a computer and the network
c)
To resolve domain names
d)
To manage routing tables
80.
What is the purpose of cookies in maintaining user sessions on websites?
a)
To store user preferences and settings
b)
To track user activity and behavior on the site
c)
To maintain session state on the client
d)
To enhance website performance
81.
What is the purpose of a CSRF token in web applications?
a)
To verify that a request comes from a legitimate user
b)
To store user session data securely
c)
To enhance the visual layout of a webpage
d)
To provide encryption for data transmission
82.
Which ARP message is broadcasted to the local network?
a)
ARP Reply
b)
Gratuitous ARP
c)
ARP Request
d)
ARP Cache Update
83.
What technique is used to prevent cross-site scripting (XSS) attacks by encoding user input?
a)
Filtering
b)
Encoding
c)
Sanitizing
d)
Escaping
84.
Which attribute specifies that a cookie should only be sent over secure channels?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
85.
What technique is commonly used to enhance security by limiting the scope of a web application’s access to user data?
a)
Access Control List (ACL)
b)
Least Privilege
c)
Sandboxing
d)
Role-Based Access Control (RBAC)
86.
What does the `-t` flag specify in an `iptables` command?
a)
The target table for the command
b)
The target chain for the command
c)
The packet type being filtered
d)
The logging level of the command
87.
What is the main purpose of the `elgg.security.token` variables in a web application?
a)
To execute server-side authentication
b)
To store encrypted passwords
c)
To dynamically assign CSRF tokens in JavaScript
d)
To validate user sessions on third-party sites
88.
Which of the following describes a common symptom of a Cross-Site Request Forgery (CSRF) attack?
a)
Unauthorized actions performed on behalf of the victim
b)
Altered browser settings without user consent
c)
Malicious software installed on the victim's device
d)
Increased loading times for websites
89.
Which attribute in cookies indicates that they should only be sent in a first-party context?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
90.
What is the primary role of the Network Interface Card (NIC) in a computer network?
a)
To store IP addresses
b)
To provide a link between a computer and the network
c)
To resolve domain names
d)
To manage routing tables
91.
What happens when an ARP cache poisoning attack is successful?
a)
The attacker can intercept and modify data sent between devices.
b)
The ARP cache entries are permanently deleted.
c)
Network speeds are significantly increased.
d)
All devices disconnect from the network.
92.
What technique is used to uniquely identify a specific session for a user in web applications?
a)
Session ID
b)
User Token
c)
Cookie
d)
Fingerprinting
93.
Which command is used to flush all rules in the `nat` table?
a)
iptables -t nat -F
b)
iptables -t filter -F
c)
iptables -F
d)
iptables -t nat -X
94.
What is the primary risk associated with Cross-Site Request Forgery (CSRF) attacks?
a)
Unauthorized actions taken on behalf of a user
b)
Exposure of sensitive information through cookies
c)
Denial of service to legitimate users
d)
Manipulation of server-side data
95.
What is the main advantage of using Role-Based Access Control (RBAC) in managing user permissions?
a)
Simplifies permission management through groups
b)
Allows users to easily change their own permissions
c)
Encrypts user data for security
d)
Automatically assigns permissions based on location
96.
What does the `--icmp-type` option in an `iptables` rule specify?
a)
The type of ICMP message to match
b)
The source IP address of the packet
c)
The action to take for all packets
d)
The destination port for the packet
97.
What does the Address Resolution Protocol (ARP) do in a network?
a)
To encrypt network packets for secure communication
b)
To discover the link layer (MAC) address given an IP address
c)
To establish a TCP connection between devices
d)
To determine the latency between two network nodes
98.
Which attribute in cookies helps ensure they are only sent in a first-party context?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
99.
What does CSRF stand for in web security?
a)
Cross-Site Request Flooding
b)
Cross-Site Resource Forgery
c)
Cross-Site Request Forgery
d)
Cross-Site Reverse Forgery
100.
What is the main function of the ARP cache in a computer network?
a)
To store resolved MAC addresses for reuse
b)
To filter ARP messages
c)
To encrypt ARP requests
d)
To block spoofed ARP replies
101.
What does the `-D` flag do in an `iptables` command?
a)
Deletes a rule from the specified chain
b)
Displays the current table rules
c)
Dumps the entire configuration
d)
Denies access to a specific IP address
102.
What is the role of cookies in web applications?
a)
Storing user preferences and session information
b)
Enhancing the loading speed of web pages
c)
Blocking unwanted ads on websites
d)
Encrypting user data transmitted over the internet
103.
What is the role of a web application firewall (WAF) in protecting against web attacks?
a)
To filter and monitor HTTP traffic between a web application and the internet
b)
To encrypt data transmitted over the internet
c)
To store user data securely on the server
d)
To enhance the visual design of a website
104.
Which of the following best describes the purpose of using cookies in web applications?
a)
Storing user preferences and settings
b)
Keeping track of user sessions and authentication
c)
Improving website loading speed
d)
Collecting user data for marketing purposes
105.
What is the primary function of Content Security Policy (CSP) in web applications?
a)
To prevent XSS attacks and data injection
b)
To enhance loading speed of web pages
c)
To manage user sessions securely
d)
To encrypt data during transmission
106.
Which command is used to allow 10 packets per minute from the source IP in `iptables`?
a)
iptables -A FORWARD -s 10.9.0.5 -m limit --limit 10/minute
b)
iptables -t nat -A INPUT <rule> -j ACCEPT
c)
iptables -t filter -A INPUT <rule> -j DROP
d)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
107.
What is the main function of the Address Resolution Protocol (ARP) in a network?
a)
To encrypt network packets for secure communication
b)
To discover the link layer (MAC) address given an IP address
c)
To establish a TCP connection between devices
d)
To determine the latency between two network nodes
108.
What happens if you execute `iptables -t nat -F`?
a)
All rules in the `filter` table are flushed.
b)
All rules in the `nat` table are removed.
c)
All firewall rules are reset.
d)
The `nat` table becomes read-only.
109.
What is the difference between Reflected XSS and Persistent XSS attacks?
a)
Reflected XSS requires user interaction; Persistent XSS stores the payload permanently.
b)
Reflected XSS attacks are always more severe than Persistent XSS attacks.
c)
Persistent XSS attacks can only occur on local machines, while Reflected XSS can occur anywhere.
d)
Reflected XSS is used exclusively in GET requests, whereas Persistent XSS is used in POST requests.
110.
What is the primary purpose of using ARP in computer networks?
a)
To encrypt network packets for secure communication
b)
To discover the link layer (MAC) address given an IP address
c)
To establish a TCP connection between devices
d)
To determine the latency between two network nodes
111.
What are the main components involved in a CSRF attack?
a)
A victim user, a trusted site, and a malicious site
b)
A server, a client, and an insecure database
c)
A compromised browser and a vulnerable server
d)
A web application and an attacker’s API
112.
What is the purpose of the `-j` option in an `iptables` command?
a)
To specify the target action for a rule
b)
To define the packet counting method
c)
To indicate the source IP address
d)
To set the logging level for the rule
113.
What technique is used to enhance web application security by validating requests with a unique token?
a)
Cross-Site Request Forgery (CSRF) protection
b)
Session management
c)
Input validation
d)
Data encryption
114.
Which attribute in cookies is used to indicate that the cookie should only be sent over secure channels?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
115.
Which command is used to allow incoming ICMP echo requests in `iptables`?
a)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
b)
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
c)
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
d)
iptables -A INPUT -p udp --dport 53 -j ACCEPT
116.
Which of the following describes how secret tokens protect against CSRF attacks?
a)
They validate requests as same-site requests
b)
They encrypt cookies
c)
They block unauthorized JavaScript execution
d)
They hide parameters in HTTP headers
117.
What is a key characteristic of the Cross-Site Scripting (XSS) attack?
a)
It executes malicious scripts in the user's browser.
b)
It requires the attacker to have physical access to the victim's device.
c)
It only affects server-side applications.
d)
It can be prevented by using stronger passwords.
118.
Which of the following methods is commonly used to prevent XSS attacks in web applications?
a)
Filtering user input
b)
Using SQL sanitization
c)
Disabling cookies
d)
Blocking JavaScript execution
119.
What is a key difference between Reflected and Persistent XSS attacks?
a)
Reflected XSS requires user interaction; Persistent XSS does not.
b)
Reflected XSS stores the payload permanently.
c)
Persistent XSS is only used in local environments.
d)
Reflected XSS uses the POST method.
120.
Which command can be used to flush all rules in the `filter` table in iptables?
a)
iptables -t filter -F
b)
iptables -F
c)
iptables -t nat -F
d)
iptables -t filter -D
121.
What is the primary advantage of using SameSite cookies in web security?
a)
They ensure cookies are only sent in first-party contexts
b)
They make cookies accessible to all websites
c)
They encrypt cookies during transmission
d)
They allow cookies to be shared across different domains
122.
Which of the following best describes the function of the `-t` flag in an `iptables` command?
a)
Specifies the chain to be used in the command
b)
Indicates the type of table to operate on
c)
Sets the default policy for a chain
d)
Displays the current configuration of the firewall
123.
What is the primary purpose of using the Address Resolution Protocol (ARP) in a network?
a)
To encrypt network packets for secure communication
b)
To discover the link layer (MAC) address given an IP address
c)
To establish a TCP connection between devices
d)
To determine the latency between two network nodes
124.
What is the primary risk associated with using weak passwords in web applications?
a)
Unauthorized access to user accounts
b)
Slow application performance
c)
Increased server downtime
d)
Compromised network speed
125.
What is the purpose of the `-t nat` option in an `iptables` command?
a)
To specify the action to be taken on packets
b)
To select the NAT table for packet manipulation
c)
To filter packets based on their source IP address
d)
To log packets that match a specific rule
126.
What is the main purpose of cookies in web applications?
a)
Storing server-side data
b)
Maintaining session state on the client
c)
Enhancing webpage aesthetics
d)
Blocking advertisements
127.
What is the main purpose of ARP cache poisoning in network attacks?
a)
To redirect network traffic to a malicious device
b)
To encrypt data packets during transmission
c)
To discover the link layer address of a device
d)
To enhance network performance
128.
What happens in a CSRF attack if the token is missing or invalid?
a)
The request is denied by the server
b)
The request is processed as if it were valid
c)
The user is logged out of their account
d)
The session is immediately terminated
129.
Which of the following is a common method used to prevent Cross-Site Scripting (XSS) attacks?
a)
Filtering user inputs
b)
Using session cookies
c)
Disabling JavaScript
d)
Encrypting all data
130.
What component is used to track the mapping of IP addresses to their corresponding MAC addresses in a network?
a)
Address Resolution Protocol (ARP)
b)
Internet Control Message Protocol (ICMP)
c)
Dynamic Host Configuration Protocol (DHCP)
d)
Network Address Translation (NAT)
131.
What is the purpose of CORS in web applications?
a)
To allow web pages to request resources from a different domain
b)
To prevent all cross-origin requests
c)
To enhance the security of local storage
d)
To block requests to third-party APIs
132.
Which of the following best describes how CSRF attacks are executed?
a)
By tricking a user into submitting a request without their knowledge
b)
By exploiting vulnerabilities in server-side code to gain access
c)
By intercepting and modifying network traffic between the user and server
d)
By installing malware on the user's device to steal credentials
133.
What is the main function of the Network Interface Card (NIC) in a computer network?
a)
To provide a link between a computer and the network
b)
To store IP addresses
c)
To manage routing tables
d)
To resolve domain names
134.
Which HTTP method is used to retrieve data from a server?
a)
GET
b)
POST
c)
PUT
d)
DELETE
135.
What is the main purpose of using hidden fields in a forged form during a CSRF attack?
a)
To display user input to attackers
b)
To store sensitive information visible to users
c)
To include necessary parameters without user detection
d)
To encrypt user data during submission
136.
What is the role of the Host M in the ARP cache poisoning lab setup?
a)
It acts as a victim machine
b)
It serves as an attacker to launch ARP cache poisoning attacks
c)
It is responsible for monitoring network traffic
d)
It represents a server for hosting network resources
137.
What technique is commonly used to prevent Cross-Site Scripting (XSS) attacks in web applications?
a)
Filtering user inputs
b)
Encrypting session cookies
c)
Using secure passwords
d)
Disabling JavaScript execution
138.
What is the purpose of the `--limit` option in an `iptables` rule?
a)
To restrict the number of packets processed per time period
b)
To specify the maximum size of packets allowed
c)
To enable logging for all packets
d)
To drop all incoming traffic
139.
What happens if you execute `iptables -t filter -F`?
a)
All rules in the filter table are removed.
b)
All rules in the nat table are flushed.
c)
All firewall rules are reset.
d)
The filter table becomes read-only.
140.
Which of the following is a characteristic of Role-Based Access Control (RBAC)?
a)
Permissions assigned based on a job function
b)
Access control is managed by a central authority
c)
Users have complete control over their own permissions
d)
Access is granted based on the user's location
141.
What role does the `-A` flag play in an `iptables` command?
a)
It appends a new rule to the specified chain.
b)
It deletes a rule from the specified chain.
c)
It lists the current rules in the specified chain.
d)
It modifies an existing rule in the specified chain.
142.
What is the purpose of using a Content Security Policy (CSP) in web applications?
a)
To prevent unauthorized access to resources
b)
To block malicious content from being executed
c)
To enhance user interface design
d)
To encrypt user sessions
143.
What is the primary purpose of a web application firewall (WAF) in protecting against web attacks?
a)
To filter and monitor HTTP traffic between a web application and the Internet.
b)
To encrypt data transmitted between the server and client.
c)
To create backups of the web application's data.
d)
To enhance the loading speed of web pages.
144.
What is the main purpose of using cookies in web applications?
a)
Storing user preferences and settings
b)
Maintaining session state on the client
c)
Tracking user behavior for advertisements
d)
Enhancing website loading speed
145.
What occurs when an attacker successfully performs an ARP cache poisoning attack?
a)
The attacker can intercept network traffic meant for the victim.
b)
The victim's device becomes immune to all types of attacks.
c)
Network performance improves significantly.
d)
All devices on the network are completely isolated.
146.
Which cookie attribute prevents cookies from being sent with cross-site requests?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
147.
Which HTTP methods can be exploited in a CSRF attack?
a)
GET only
b)
POST only
c)
Both GET and POST
d)
Only non-secure methods
148.
What is the primary purpose of a CSRF token in web applications?
a)
To prevent unauthorized actions on behalf of a user
b)
To encrypt user credentials
c)
To enhance the visual appearance of a webpage
d)
To improve server response time
149.
What is the role of Host M in the ARP cache poisoning lab setup?
a)
It acts as a victim machine
b)
It serves as an attacker to launch ARP cache poisoning attacks
c)
It is responsible for monitoring network traffic
d)
It represents a server for hosting network resources
150.
What is the primary purpose of the `--limit` option in an `iptables` rule?
a)
To restrict the number of packets allowed in a specific time period
b)
To define the source IP address for packet filtering
c)
To specify the destination port for the rule
d)
To enable logging for dropped packets
151.
What is the primary function of the `-j` option in an `iptables` command?
a)
To specify a target for the rule
b)
To set the policy for a chain
c)
To define the protocol type
d)
To flush existing rules
152.
What is the primary difference between Discretionary Access Control (DAC) and Mandatory Access Control (MAC)?
a)
DAC is owner-controlled, MAC is policy-enforced
b)
DAC uses labels, MAC uses ACLs
c)
DAC is centralized, MAC is decentralized
d)
DAC is more secure than MAC
153.
Which of the following techniques is used to enhance security by ensuring that cookies are only sent in a first-party context?
a)
SameSite cookies
b)
Cross-Origin Resource Sharing (CORS)
c)
HttpOnly cookies
d)
Persistent cookies
154.
What technique is commonly used to enhance web application security by validating requests with a unique token?
a)
CSRF tokens
b)
Session cookies
c)
SameSite cookies
d)
Referer headers
155.
Which of the following statements best describes Cross-Site Request Forgery (CSRF) attacks?
a)
They exploit the trust a website has in a user's browser.
b)
They require the attacker to gain physical access to the victim's device.
c)
They involve stealing sensitive data through phishing.
d)
They rely on injecting malware into the user's system.
156.
Which of the following is used to prevent unauthorized access to resources in a system?
a)
Access control lists
b)
Firewalls
c)
Encryption
d)
User authentication
157.
What is the purpose of the Address Resolution Protocol (ARP) in a network?
a)
To encrypt network packets for secure communication
b)
To discover the link layer (MAC) address given an IP address
c)
To establish a TCP connection between devices
d)
To determine the latency between two network nodes
158.
Which command in iptables allows you to accept incoming ICMP echo requests?
a)
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
b)
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
c)
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
d)
iptables -A INPUT -p tcp -j ACCEPT
159.
What is the primary function of the `-F` flag in an `iptables` command?
a)
To flush all rules in the specified table
b)
To specify a chain for packet filtering
c)
To set the default policy for a chain
d)
To add a new rule to the chain
160.
What is the main function of a cookie in web applications?
a)
Storing user preferences
b)
Maintaining session state on the client
c)
Tracking user behavior for analytics
d)
Enhancing webpage aesthetics
161.
What is the main function of the Access Control List (ACL) in network security?
a)
To grant or deny access to network resources
b)
To encrypt data transmitted over the network
c)
To monitor network traffic for anomalies
d)
To optimize network performance
162.
What does the term "XSS" stand for in web security?
a)
Cross-Site Scripting
b)
Cross-Site Security
c)
Cross-Site Session
d)
Cross-Site Storage
163.
Which technique is commonly used to prevent Cross-Site Scripting (XSS) attacks in web applications?
a)
Input validation
b)
Content Security Policy (CSP)
c)
Encoding user inputs
d)
Using strong passwords
164.
What is the primary purpose of the `--icmp-type` option in an `iptables` rule?
a)
To specify the type of ICMP traffic to match
b)
To set the priority of the rule in the chain
c)
To determine the source IP address of packets
d)
To log incoming and outgoing ICMP packets
165.
What is the primary purpose of using cookies in web applications?
a)
Storing server-side data
b)
Maintaining session state on the client
c)
Enhancing webpage aesthetics
d)
Blocking advertisements
166.
What is the main purpose of using a web application firewall (WAF) in protecting against web attacks?
a)
To filter and monitor HTTP traffic between a web application and the Internet
b)
To improve website loading speed and performance
c)
To provide data storage for web applications
d)
To enhance user interface design and navigation
167.
What is the main function of the Address Resolution Protocol (ARP) in a computer network?
a)
To encrypt network packets for secure communication
b)
To discover the link layer (MAC) address given an IP address
c)
To establish a TCP connection between devices
d)
To determine the latency between two network nodes
168.
Which of the following best describes the function of cookies in web applications?
a)
Storing user preferences and session information
b)
Enhancing webpage loading speed
c)
Tracking user behavior for analytics
d)
Blocking cross-site scripting attacks
169.
What is the purpose of a session cookie in web applications?
a)
To store user preferences for a website
b)
To maintain the user's session state while they navigate different pages
c)
To enhance website loading speed
d)
To track user behavior for advertising purposes
170.
What is the primary difference between Access Control Lists (ACL) and Role-Based Access Control (RBAC)?
a)
ACL defines permissions based on user identity, while RBAC assigns permissions based on user roles.
b)
ACL is more secure than RBAC because it uses encryption.
c)
RBAC is easier to manage than ACL because it requires fewer rules.
d)
ACL provides access based on time of day, while RBAC does not.
171.
What is the main cause of a security vulnerability in a web application?
a)
Poor input validation
b)
Strong authentication mechanisms
c)
Regular software updates
d)
Secure coding practices
172.
Which of the following describes the typical outcome of an XSS attack?
a)
Execution of server-side scripts
b)
Theft of session cookies
c)
Loss of database schema
d)
Denial of Service (DoS)
173.
Which of the following describes the primary role of a cookie in web applications?
a)
Storing server-side data
b)
Maintaining session state on the client
c)
Enhancing webpage aesthetics
d)
Blocking advertisements
174.
What is the primary function of a cookie in maintaining user sessions on websites?
a)
Storing user preferences for website appearance
b)
Maintaining session state on the client
c)
Tracking user behavior for advertising
d)
Encrypting user data for security
175.
What is the purpose of using Content Security Policy (CSP) in web applications?
a)
To enhance user interface
b)
To prevent cross-site scripting attacks
c)
To improve server response times
d)
To manage user authentication
176.
What is the role of the Referer header in web security?
a)
To specify the website a request originated from
b)
To encrypt the data being transmitted
c)
To store user session data
d)
To authenticate users
177.
What type of XSS attack involves the injection of malicious scripts into a user's session without permanent storage?
a)
Reflected XSS
b)
Persistent XSS
c)
DOM-based XSS
d)
Cross-Site Request Forgery (CSRF)
178.
What technique is commonly used to enhance security by ensuring that cookies are only sent in a first-party context?
a)
Secure cookies
b)
SameSite cookies
c)
HttpOnly cookies
d)
Persistent cookies
179.
Which command can be used to allow a specific IP address to send ICMP packets in iptables?
a)
iptables -A INPUT -s <IP_ADDRESS> -p icmp -j ACCEPT
b)
iptables -A INPUT -d <IP_ADDRESS> -p icmp -j ACCEPT
c)
iptables -A OUTPUT -s <IP_ADDRESS> -p icmp -j ACCEPT
d)
iptables -A FORWARD -s <IP_ADDRESS> -p icmp -j ACCEPT
180.
What is the primary purpose of Cross-Origin Resource Sharing (CORS) in web applications?
a)
To allow restricted access to resources on a web server from another domain
b)
To enhance the performance of web applications
c)
To prevent all types of cross-origin requests
d)
To encrypt data during transmission between different origins
181.
What are the three common access rights in Unix systems?
a)
Read, Write, Search
b)
Read, Write, Execute
c)
Read, Delete, Create
d)
Write, Modify, Search
182.
Which of the following describes a common method used to prevent Cross-Site Scripting (XSS) attacks in web applications?
a)
Filtering user inputs to remove harmful scripts
b)
Using only GET requests for data retrieval
c)
Disabling JavaScript on the browser
d)
Allowing all types of cookies
183.
What technique is used to track the connection states of packets in `iptables`?
a)
Connection tracking
b)
Packet filtering
c)
NAT traversal
d)
Session management
184.
What does the `-j` option do in an `iptables` command?
a)
It specifies the target action for a rule.
b)
It sets the priority of the rule.
c)
It lists the current rules in a table.
d)
It defines a logging mechanism.
185.
What is the main difference between discretionary access control (DAC) and attribute-based access control (ABAC)?
a)
DAC is owner-controlled while ABAC uses attributes for access decisions.
b)
DAC relies on system policies, whereas ABAC does not.
c)
DAC is used only in file systems, while ABAC is used in networks.
d)
DAC allows for more granular control than ABAC.
186.
Which component is primarily responsible for ensuring that cookies are not sent with cross-site requests?
a)
Secure
b)
HttpOnly
c)
SameSite
d)
Path
187.
What is the primary purpose of the `elgg_ts` parameter in web applications?
a)
To allow session persistence
b)
To validate legitimate requests and defend against CSRF
c)
To enable faster API responses
d)
To encrypt user credentials
188.
What is the purpose of using `SameSite` cookies in web applications?
a)
To block third-party requests from sending cookies
b)
To encrypt cookies for secure transmission
c)
To enable cross-domain authentication
d)
To allow faster HTTP responses
189.
What is the role of an ARP Request in a network?
a)
To discover the link layer (MAC) address corresponding to an IP address
b)
To establish a TCP connection between devices
c)
To encrypt network packets for secure communication
d)
To determine the latency between two network nodes
190.
Which command is used to allow a specific IP address to send ICMP packets in iptables?
a)
iptables -A INPUT -s <specific_IP> -p icmp -j ACCEPT
b)
iptables -A OUTPUT -s <specific_IP> -p icmp -j DROP
c)
iptables -A FORWARD -s <specific_IP> -p icmp -j REJECT
d)
iptables -A INPUT -d <specific_IP> -p icmp -j ACCEPT
191.
What is the role of the `-m limit` option in an `iptables` rule?
a)
To specify connection tracking parameters
b)
To limit the rate of packets that match the rule
c)
To define the action taken for matching packets
d)
To set the default policy for a chain
192.
What is the purpose of using a web application firewall (WAF) in protecting against web attacks?
a)
To filter and monitor HTTP traffic to and from a web application
b)
To encrypt data transmitted between users and the web application
c)
To provide a backup solution for web application data
d)
To enhance the user interface of web applications
193.
What is the purpose of the `--dport` option in an `iptables` rule?
a)
To specify the destination port for the rule
b)
To specify the source port for the rule
c)
To ignore port settings in the rule
d)
To set the default port for all connections
194.
What is the main difference between XSS and CSRF attacks?
a)
XSS attacks involve injecting malicious scripts into webpages, while CSRF attacks exploit the trust a site has in a user's browser.
b)
XSS attacks target the server directly, while CSRF attacks target the database.
c)
XSS attacks require user interaction to succeed, while CSRF attacks do not.
d)
XSS attacks can only occur on public websites, while CSRF attacks can happen on private ones.
195.
What is the role of cookies in maintaining user sessions on websites?
a)
Storing user preferences for future visits
b)
Tracking users' browsing history across different sites
c)
Maintaining session state on the client
d)
Encrypting sensitive user data
196.
What is the primary purpose of using session cookies in web applications?
a)
To store user preferences for future visits
b)
To maintain the user's logged-in state during a session
c)
To track user behavior across different websites
d)
To enhance webpage loading speed
197.
What technique is commonly used to validate requests in web applications to prevent CSRF attacks?
a)
Secret tokens
b)
Referer headers
c)
SameSite cookies
d)
Captchas
198.
What is the primary purpose of the `HttpOnly` attribute in cookies?
a)
To prevent client-side scripts from accessing the cookie
b)
To ensure cookies are sent only over secure connections
c)
To store user preferences in the browser
d)
To allow cross-site requests with the cookie
199.
What is the main purpose of Cross-Origin Resource Sharing (CORS) in web applications?
a)
To restrict access to resources based on the origin of requests
b)
To allow web applications to make requests to different domains
c)
To enhance the security of API endpoints
d)
To improve website loading speed
200.
What is the purpose of XSS attacks in web security?
a)
To steal sensitive information from users
b)
To enhance the visual appeal of a website
c)
To improve website loading speed
d)
To eliminate the need for user authentication
Reset
