Threats and Mitigations
13) Which of the following are injection attacks? a. Cross-site scripting b. Cross-site request forgery c. Insecure direct object references d. Broken authentication and session management
a
14) Which of the following languages are the primary targets of cross-site scripting? a. HTML b. SQL c. XSLT d. XPath
a
15) Which of the following attacks occurs when a malicious user convinces a victim to send a request to a server with malicious input and the server echoes the input back to client? a. Reflected XSS b. Persistent XSS c. Insecure direct object references d. Failure to restrict URL access
a
18) Which of the following is the best way to prevent malicious input exploiting your application? a. Input validation using an allow List b. Using encryption c. Using table indirection d. Using GET/POST parameters
a
19) You should set the HttpOnly flag in a cookie to ensure that: a. The cookie is not available to client scripts. b. The cookie is deleted when the user closes the browser. c. The cookie is sent over an encrypted channel. d. The cookie is a persistent cookie.
a
2) Your application is created using a language that does not support a clear distinction between code and data. Which vulnerability is most likely to occur in your application? a. Injection b. Insecure direct object references c. Failure to restrict URL access d. Insufficient transport layer protection
a
22) Which of the following input sources can be directly controlled by a malicious user? a. GET/POST parameters b. Server configuration files c. Ports d. Server code
a
23) Which of the following scenarios is most likely to result in broken authentication and session management vulnerabilities? a. Poorly implemented custom code is used. b. Session-based indirection is used. c. Unused and unnecessary services, code, and DLLs are disabled. d. The HttpOnly flag is set in cookies.
a
26) Which of the following functionalities should you include in an authentication and session management system? a. Logout functionality b. Regular expressions c. Escaping functionality d. Forwarding system functionality
a
28) What should you do before passing credentials over the network? a. Replace the credentials with a cryptographic salt and hash. b. Accept session IDs from URLs. c. Share the credentials with the client. c. Use persistent cookies to manage session IDs.
a
3) Which of the following scenarios is most likely to cause an injection attack? a. Unvalidated input is embedded in an instruction stream. b.Unvalidated input can be distinguished from valid instructions. c. A Web application does not validate a client's access to a resource. d. A Web action performs an operation on behalf of the user without checking a shared secret
a
34) Which of the following tasks is performed by a session-based system? a. Identifying returning users b. Using form variables for managing session IDs c. Using the HTTP protocol d. Sending successful logins to a well-known location
a
38) Which of the following is the best way to mitigate the threat of an insecure direct object reference attack? a. Use session-based indirection. b. Use POST parameters instead of GET parameters. c. Use a regular expression. d. Send successful logins to a well-known location instead of automatic redirection.
a
39) State whether the following statement is True or False. Time of Check Time of Use (TOCTOU) occurs if the authorization check is performed on one page of a Web site and the resource is used on a different page. a. True b. False
a
4) A user is able to pass malicious input that invokes control codes in your Web application. Which vulnerability is most likely to occur in your Web application? a. Injection b. Insecure direct object references c. Failure to restrict URL access d. Insufficient transport layer protection
a
42) Which threat is most likely to occur when a POST parameter performs an operation on behalf of a user without checking a shared secret? a. Cross-site request forgery b. Insecure direct object reference c. Cross-site scripting d. Injection
a
43) Which of the following is the most common result of a cross-site request forgery? a. Elevation of privilege b. Disabled security features c. Enabling of IPSec d. Misconfigured security features
a
51) Which of the following is the best way to reevaluate your environment and address new threats? a. Add or remove network segments. b. Use the white-list validation of allowed input technique. c. Use custom cryptographic algorithms. d. Use your browser to forge unauthorized requests.
a
52) Which of the following procedures are involved in the hardening process? a. Disable unnecessary features. b. Resubmit POST parameters during redirection. c. Repeat the process at random intervals. d. Update the environment with changes only when needed.
a
53) Which of the following consequence is most likely to result if your production environment does not match your development, testing, and staging environments? a. Your application may not work as expected. b. Testing your application may take a long time. c. Your application may be expensive to administer. d. Your application may have too many configuration files.
a
54) Which of the following can result in insecure cryptography? a. Unsalted hash b. Unused services c. Default accounts d. Rotating keys frequently
a
58) Which of the following factors helps you secure keys? a. Complexity b. Session-based indirection c. Escaping d. Encryption
a
65) Which of the following is the best way to protect a Web application from unvalidated redirects and forwards? a. Validate the referrer header. b. Use extended validation certificates. c. Use the escaping technique. d. Disallow requests to unauthorized file types.
a
67) State whether the following statement is True or False. Most security issues are related to input and a user's ability to interact with and control input. a. True b. False
a
68) State whether the following statement is True or False. If user input can be confused for instructions in the language or the way the language is applied, then the language is vulnerable to an injection attack. a. True b. False
a
69) In which of the following scenarios should you use the escaping technique? a. When user input is echoed back to the user in HTML b. When you need to validate any input as valid input c. When you are trying to protect against regular expression injection d. When you need to tell the interpreter that input is code
a
7) Which character is most likely to be used for an SQL injection attack? a. Single quote (') b. Null (\0) byte c. Less than sign(<) d. Greater than sign(>)
a
70) Which of the following is the best way to prevent unvalidated redirect and forwards vulnerabilities? a. Use an allow list, such as table indirection. b. Use client-side validation. c. Allow only absolute redirects. d. Use session-based indirection.
a
8) Which mitigation technique can help you strictly define valid input? a. Allow list b. Memory size checks c. Table indirection d. Escaping
a
11) State whether the following statement is True or False. You should use a blacklist wherever possible; use whitelists only as a secondary defense. a. True b. False
b
12) Which of the following is the best way to define disallowed inputs? a. Allow list b. Block list c. Table indirection d. Escaping
b
17) How does malicious input flow in a DOM-based XSS? a. From server to client b. From client to itself c. From attacker to server d. From victim to server
b
24) Which of the following actions should you take before implementing a custom authentication and session management system? a. Find out if the HttpOnly flag is set in cookies. b. Find out if you can use a small extension to an existing component to implement the system. c. Find out if form variables are available to store data. d. Find out if you need to use session-based indirection.
b
25) State whether the following statement is True or False. When implementing an authentication or session system, you should ensure that new session IDs are not created at login. a. True b. False
b
30) Which of the following is the best way to ensure that JavaScript cannot be used to access a cookie? a. Set the secure flag in the cookie b. Set the HttpOnly flag in the cookie c. Use the CAPTCHA system d. Use non-persistent cookies
b
33) State whether the following statement is True or False. An identification token is a replacement for a user's credentials and should allow access to restricted resources of a Web site. a. True b. False
b
36) Which of the following objects is most susceptible to an insecure direct object reference attack? a. Nonpersistent cookies b. Registry keys c. Conditional constructs d. GET/POST parameters
b
40) Your Web application stores information about many accounts. Which threat is your Web application susceptible to if you can manipulate the URL of an account page to access all accounts? a. Cross-site request forgery b. Insecure direct object reference c. Cross-site scripting d. Injection
b
41) Which of the following threats is most likely to be caused by poor input validation? a. Enabling of IPSec b. Insecure direct object reference c. Insecure cryptographic storage d. Insufficient transport layer protection
b
45) State whether the following statement is True or False. The downside of a nonce is that it needs to be stored on the client. a. True b. False
b
48) State whether the following statement is True or False. HTTP GET parameters limit the types of manipulation a malicious user can perform on the victim to forge a request. a. True b. False
b
49) Which of the following mistakes is most often associated with a security misconfiguration threat? a. Cross-site request forgery b. Failure to disable default accounts c. Bad cryptography d. Unsafe key storage
b
5) Which of the following is the best way to protect against injection attacks? a. SQL queries based on user input b. Input validation using an allow list c. Memory size checks d. Validate integer values before referencing arrays
b
50) You have not yet applied some recent service packs and updates to your Web application. Which of the following threats is your Web server susceptible to? a. Injection b. Security misconfiguration c. Insecure cryptographic storage d. Cross-site request forgery
b
55) Which of the following is most likely to result in insecure cryptography? a. Unused services b. Unsalted hash c. New products d. Missing patches
b
56) Which of the following may result in cryptographic weakness? a. Failure to restrict URL access b. Insufficient cryptographic protocols c. Missing patches d. Unnecessary/unused services or features
b
59) Which of the following combines public-key cryptography with a cryptographic hash? a. Nonce b. Digital signature c. SSL d. Salt
b
62) Which of the following should you use to protect the connections between the physical tiers of your application? a. EFS b. SSL c. HTTP d. Kerberos
b
63) Which of the following is the best way to implement transport layer protection? a. Install IDS b. Enable SSL c. Set the HttpOnly flag on session ID cookies d. Perform client-side validation.
b
9) Which of the following architecture-level techniques are the best approaches to prevent attacks based on malicious input? a. Allow list b. Table indirection c. Escaping d. Memory size checks
b
1) Which of the following consequences is most likely to occur due to an injection attack? a. Spoofing b. Cross-site request forgery c. Denial of service d. Insecure direct object references
c
10) Which mitigation technique helps you tell the parser that a specific character is a literal and not a control character? a. Table indirection b. Allow list c. Escaping d. Block list
c
20) You should set a secure flag in a cookie to ensure that: a. The cookie is a persistent cookie. b. The cookie is not available to client script. c. The cookie is sent over an encrypted channel. d. The cookie is deleted when the user closes the browser.
c
21) An attacker submits data to the server and the data is stored on the server. Which type of vulnerability is most likely to occur in your application? a. DOM-based XSS b. Reflected XSS c. Persistent XSS d. Cross-site request forgery
c
27) Why should you use CAPTCHA? a. To create cryptographically random session IDs b. To protect credentials by using encryption or cryptographic salt and hash c. To protect authentication systems from automated or brute-force attacks d. To ensure that authentication systems implement inactivity timeout functionality
c
31) Which of the following is an authentication system mandatory requirement? a. Form variables are used for managing session IDs. b. Use a GOTCHA to prevent automated attacks. c. User logout and session inactivity controls. d. Session IDs are only accepted from cookies and parameter variables.
c
35) Which threat is most likely to occur when a Web application fails to validate a client's access to a resource? a. Injection b. Cross-site scripting c. Insecure direct object reference d. Cross-site request forgery
c
47) Which of the following practices should you observe in order to implement defense-in-depth techniques against CSRF attacks? a. Use GET parameters b. Use automatic redirection. c. Don't include secrets in the URL. d. Resubmit POST parameters during redirection.
c
57) Which of the following protocols is a network layer encryption protocol? a. HTTP b. EFS c. IPSec d. Kerberos
c
6) Which of the following is most vulnerable to injection attacks? a. Session IDs b. Registry keys c. Regular expressions d. Server configuration files
c
60) hich of the following depicts the typical impact of failure to restrict URL access? a. Attackers perform man-in-the-middle attacks. b. Attackers impersonate any user on the system. c. Attackers invoke functions and services they have no authorization for. d. Attackers perform all actions that the victims themselves have permission to perform.
c
64) Which of the following is most likely to result from unvalidated redirects and forwards? a. Brute force attack b. Network sniffing c. Man-in-the-middle d. Bypassed authorization checks
c
66) Which of the following is the best way to detect unvalidated redirects and forwards? a. Use internal transfers without authorizing the user for target URL b. Use your browser to forge unauthorized requests c. Use weblogs to identify redirects and forwards d. Use policy mechanisms
c
16) Which of the following is the best way to prevent a DOM-based XSS attack? a. Set the HttpOnly flag in cookies b. Ensure that session IDs are not exposed in a URL c. Ensure that a different nonce is created for each request d. Validate any input that comes from another Web site
d
29) Which location should you ideally use to store a session ID? a. URLs b. Form variables c. Persistent cookies d. Non-persistent cookies
d
32) A session-based system authenticates a user to a Web site to provide access to restricted resources. To increase security in this scenario, an authentication token should meet which of the following requirements? a. It should identify returning users to the site. b. It should be public information. c. It should always use a persistent cookie. d. It should always use a non-persistent cookie.
d
37) Which of the following vulnerabilities is most likely to occur due to an insecure direct object reference attack? a. Executing commands on the server. b. Impersonating any user on the system. c. Modifying SQL data pointed to by the query. d. Accessing a resource without authorization.
d
44) An attacker lures a victim to malicious content on a Web site. A request is automatically sent to the vulnerable site which includes victim's credentials. Which attack is most likely to occur in this scenario? a. Injection b. Cross-site scripting c. Insecure direct object reference d. Cross-site request forgery
d
46) What should you add to an HMAC to ensure that the secret value is unique for each request? a. Salt b. Nonce c. Session ID d. Timestamp
d
61) Which of the following actions should you take to test the security of your Web application? a. Use policy mechanisms. b. Use a simple and positive model at every layer. c. Set the secure flag on session ID cookies. d. Use your browser to forge unauthorized requests.
d
