Worksheets01 OWASP Introduction to Web Security
Total questions: 30
Worksheet time: 15mins
Name
Class
Date
1.
What does “Web Security” aim to protect?
a)
Only hardware
b)
Web apps and data
c)
Network cables
d)
Email systems
2.
What does HTTP stand for?
a)
Hyper Text Transfer Protocol
b)
Hyper Text Transmission Process
c)
Host Text Transfer Protocol
d)
Hyper Transfer Type
3.
HTTP is considered what type of protocol?
a)
Stateful
b)
Stateless
c)
Secure
d)
Encrypted
4.
What is a cookie used for?
a)
Data caching
b)
Client-server session tracking
c)
File encryption
d)
Email storage
5.
What is a “Session Cookie”?
a)
Stored permanently
b)
Deleted when browser closes
c)
Shared across devices
d)
Encrypted cookie
6.
What is a “Secure Cookie”?
a)
Used only via HTTPS
b)
Accessible by JavaScript
c)
Used only offline
d)
Temporary cache
7.
What is “HttpOnly” used for in cookies?
a)
To make cookies accessible by JavaScript
b)
To restrict cookies to HTTP/HTTPS only
c)
To encrypt cookie data
d)
To track analytics
8.
What is a vulnerability?
a)
A known system weakness
b)
A detected malware
c)
A physical network issue
d)
A risk assessment tool
9.
Which of the following is not a type of threat?
a)
Natural
b)
Intentional
c)
Unintentional
d)
Procedural
10.
What does CIA triad stand for?
a)
Control, Integrity, Access
b)
Confidentiality, Integrity, Availability
c)
Communication, Identity, Access
d)
Confidentiality, Isolation, Authorization
11.
Which concept of CIA ensures data is not modified improperly?
a)
Confidentiality
b)
Integrity
c)
Availability
d)
Authorization
12.
Which principle ensures systems stay online and accessible?
a)
Confidentiality
b)
Authorization
c)
Availability
d)
Privacy
13.
Is “absolute security” possible?
a)
Yes
b)
No
c)
Only offline
d)
Only with encryption
14.
Security should balance between what two elements?
a)
Performance and cost
b)
Usability and security
c)
Privacy and ethics
d)
Risk and testing
15.
Which best defines a “Threat”?
a)
A detected vulnerability
b)
A potential cause of harm
c)
An existing risk
d)
A software patch
16.
What does “Shift-left Security” mean?
a)
Testing only at the end
b)
Adding security early in SDLC
c)
Ignoring tests
d)
Using external audits only
17.
Why are APIs a security challenge in microservices?
a)
They are hidden
b)
They are public and easy to reverse engineer
c)
They cannot be secured
d)
They are encrypted by default
18.
What is the main reason for security concerns in cloud migration?
a)
Vendor lock-in
b)
Network latency
c)
Shared resources and exposure
d)
File system limits
19.
What defines “IT Security”?
a)
Protecting network data and assets
b)
Only software testing
c)
Website design
d)
Data visualization
20.
What defines “Web Security”?
a)
Server OS protection
b)
Application-level protection
c)
Hardware maintenance
d)
Email encryption
21.
What does the “Availability” aspect of the CIA triad defend against?
a)
Password theft
b)
DDoS attacks
c)
SQL Injection
d)
XSS
22.
What is the role of “Integrity” in IT security?
a)
Ensure data accuracy
b)
Encrypt data
c)
Back up systems
d)
Improve response time
23.
What is “Same-Origin Policy” (SOP)?
a)
Allows any origin access
b)
Restricts web interactions to the same origin
c)
Manages session cookies
d)
Prevents HTTPS encryption
24.
What does CORS stand for?
a)
Cross-Origin Resource Sharing
b)
Common Origin Request System
c)
Client-Origin Resource Security
d)
Control Origin Response Strategy
25.
What is the purpose of CORS?
a)
Prevent caching
b)
Allow secure cross-origin requests
c)
Block HTTPS
d)
Disable cookies
26.
What does HSTS enforce?
a)
HTTPS usage
b)
Cookie encryption
c)
CORS rules
d)
XSS filtering
27.
What does “Content Security Policy (CSP)” help prevent?
a)
SQL Injection
b)
Cross-Site Scripting (XSS)
c)
DDoS attacks
d)
Session hijacking
28.
What does “X-Frame-Options: SAMEORIGIN” prevent?
a)
Caching
b)
Clickjacking
c)
Cookie theft
d)
Header injection
29.
What does HTTP use to transfer data between client and server?
a)
Packets of cookies
b)
Request and response messages
c)
Database queries
d)
Encryption keys
30.
Which statement is true about HTTP?
a)
It encrypts all data
b)
It is secure by default
c)
It is stateless
d)
It maintains session info
100 %
