WorksheetsWCM Competency 4 Slide 21 to 40
Total questions: 15
Worksheet time: 8mins
What is the main purpose of performance testing?
To check font consistency across browsers
To reduce HTML file sizes only
To ensure the site works under all loads, including peak loads
To test marketing campaign effectiveness
Load testing focuses on:
Identifying broken CSS rules
Checking for SQL injection vulnerabilities
Measuring image download sizes
Determining how the website behaves under normal and peak traffic
Stress testing is used to:
Identify the system’s breakpoint when pushed beyond normal loads
Verify cookie expiration times
Test users’ password strength
Ensure external links work on mobile
According to the slides, which tool can be used during security testing of a website?
Photoshop
Canva
JMeter
Microsoft Word
Security testing is essential mainly because:
It improves the website's font style
It increases the number of website visitors
It makes the layout more responsive
It identifies vulnerabilities that could allow malicious attacks
Which of the following should be prevented during security testing?
Unauthorized access to secure pages
Users resizing the browser
Users taking screenshots of pages
Scrolling to the bottom of the page
What is SQL Injection?
A tool for improving SEO ranking
A method for compressing SQL files
A vulnerability where attackers manipulate database queries to access or change data
A backup method for database servers
What is the best protection against SQL Injection mentioned in the slides?
Encrypting all images on the site
Whitelisting and filtering all input
Using only the POST method in forms
Disabling cookies for all users
Cross-Site Scripting (XSS) attacks usually involve:
Injecting images into SQL queries
Replacing CSS files dynamically
Modifying server operating systems
Injecting client-side scripts such as JavaScript into a web application’s output
A common way to prevent XSS is to:
Disable all CSS styles
Remove all images from the page
Convert HTML tags to safe HTML entities before sending them to the client
Block all GET requests
Broken authentication and session management can allow attackers to:
Hijack an active user session and assume the user’s identity
Change the website’s colour theme
Automatically translate the website
Resize the browser window
Insecure Direct Object Reference occurs when:
A CSS file fails to load properly
A browser cannot open cookies
A script tag is missing in HTML
A web application exposes internal objects such as files or database records so attackers can manipulate them
A common defence against Insecure Direct Object References is to:
Perform proper user authorization and whitelisting of choices
Increase image resolution
Use only inline CSS styles
Add more navigation menus
What is Cross-Site Request Forgery (CSRF)?
A browser compatibility issue caused by old versions
A method of compressing JavaScript files
A malicious attack where users are tricked into performing actions they did not intend to do
A performance testing technique
How can CSRF be prevented, according to the slides?
Deleting all browser history on logout
Storing a secret token in a hidden form field and verifying it for each request
Using only HTTP GET requests
Blocking all third-party websites
