MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

1. Which type of attack manipulates an application to execute an attacker-supplied SQL query?
   a. SQL injection
   b. SQL
   c. Direct
   d. Application
   Answer: a. SQL injectionsanfoundry
2. A website that allows storage of user-supplied text and later displays it is vulnerable to what attack?
   a. Two-factor authentication
   b. Cross-site request forgery
   c. Cross-site scripting
   d. Cross-site scoring scripting
   Answer: c. Cross-site scriptingsanfoundry
3. What attack forces an authenticated user to execute unwanted actions on a web application?
   a. Two-factor authentication
   b. Cross-site request forgery
   c. Cross-site scripting
   d. Cross-site scoring scripting
   Answer: b. Cross-site request forgerysanfoundry
4. Single sign-on allows a user to authenticate once and access multiple applications. Which technology helps enable this?
   a. OpenID
   b. Sign-on system
   c. Security Assertion Markup Language (SAML)
   d. Virtual Private Database (VPD)
   Answer: c. Security Assertion Markup Language (SAML)sanfoundry
5. According to the OWASP Top 10, which vulnerability involves not validating authorization of a user for direct file access?
   a. Insecure Direct Object Reference
   b. Broken Access Control
   c. SQL Injection
   d. Cross-Site Scripting
   Answer: b. Broken Access Controltestbook
6. Using default or weak passwords like “admin123” exposes applications to which vulnerability?
   a. Broken Authentication
   b. Insecure Deserialization
   c. Security Misconfiguration
   d. Sensitive Data Exposure
   Answer: a. Broken Authenticationtestbook
7. What is the most common vulnerability related to database queries in applications?
   a. Information Exposure
   b. SQL Injection
   c. Insecure Storage
   d. XML Injection
   Answer: b. SQL Injectionsisainfosec
8. Which vulnerability enables an attacker to execute code by exploiting a buffer size error?
   a. Buffer Overflow
   b. Cross-Site Scripting
   c. Injection
   d. File Inclusion
   Answer: a. Buffer Overflowqaautomation
9. What does the term “privilege escalation” mean in web application security?
   a. Granting all users admin access
   b. Attacker gaining unauthorized higher privileges
   c. Prioritizing patches by severity
   d. Using complex authentication
   Answer: b. Attacker gaining unauthorized higher privilegesqaautomation
10. Which attack involves injecting client-side script into a web page viewed by others?
    a. XML Injection
    b. Credential Stuffing
    c. Cross-Site Scripting (XSS)
    d. Broken Authentication
    Answer: c. Cross-Site Scripting (XSS)testbook
11. Which HTTP header helps mitigate XSS by controlling which resources the browser can load?
    a. Content-Type
    b. Strict-Transport-Security
    c. Content-Security-Policy
    d. Cache-Control
    Answer: c. Content-Security-Policyqaautomation
12. What is the usual result of a successful buffer overflow?
    a. Data leakage
    b. Execution of arbitrary code
    c. Network eavesdropping
    d. Denial of service
    Answer: b. Execution of arbitrary codeqaautomation
13. Which OWASP category added in 2021 deals with the absence of security measures at design time?
    a. Security Misconfiguration
    b. Broken Authentication
    c. Insecure Design
    d. Using Components with Known Vulnerabilities
    Answer: c. Insecure Designallabouttesting
14. What attribute in cookies prevents JavaScript from accessing the cookie?
    a. Secure
    b. Path
    c. HttpOnly
    d. Domain
    Answer: c. HttpOnlyqaautomation
15. What type of attack attempts to trick users into clicking maliciously crafted links that perform actions?
    a. Cross-Site Request Forgery (CSRF)
    b. Phishing
    c. SQL Injection
    d. Man-in-the-middle
    Answer: a. Cross-Site Request Forgery (CSRF)testbook
16. Which risk is associated with not encrypting sensitive data sent between user and server?
    a. SQL Injection
    b. Sensitive Data Exposure
    c. Insecure Deserialization
    d. Broken Access Control
    Answer: b. Sensitive Data Exposuretestbook
17. What kind of vulnerability results from using components with unpatched flaws in an application?
    a. Software and Data Integrity Failure
    b. Security Misconfiguration
    c. Using Components with Known Vulnerabilities
    d. Cross-Site Scripting
    Answer: c. Using Components with Known Vulnerabilitiestestbook
18. Insufficient logging and monitoring most directly increases risk of which outcome?
    a. Faster updates
    b. Undetected breaches
    c. Weak encryption
    d. Data redundancy
    Answer: b. Undetected breachestestbook
19. What is the function of a web application firewall (WAF)?
    a. Block all network attacks
    b. Block unauthorized e-mails
    c. Filter and monitor HTTP traffic
    d. Encrypt data at rest
    Answer: c. Filter and monitor HTTP trafficqaautomation
20. What is the best defense against code injection vulnerabilities?
    a. Blacklisting input patterns
    b. Input validation using an allow list
    c. Disabling user input
    d. Increasing memory size
    Answer: b. Input validation using an allow listkoenig-solutions
21. What is a common method for attackers to find web app vulnerabilities?
    a. Social engineering
    b. Penetration testing
    c. Cash transactions
    d. Phone calls
    Answer: b. Penetration testingqaautomation
22. What is the main risk in using default configurations for web applications?
    a. Performance degradation
    b. Increased vulnerability to attacks
    c. Browser incompatibility
    d. Accessibility issues
    Answer: b. Increased vulnerability to attacksqaautomation
23. Protecting applications from SQL Injection involves:
    a. Accepting all input
    b. Using parameterized queries
    c. Disabling SQL logging
    d. Buying new hardware
    Answer: b. Using parameterized queriessisainfosec
24. Failure to escape user input in HTML templates can result in:
    a. Encryption issues
    b. Cross-site scripting
    c. Slow performance
    d. Data backup failure
    Answer: b. Cross-site scriptingtestbook
25. What can happen if error messages reveal too much info about application internals?
    a. Stronger security
    b. Sensitive data exposure
    c. Session fixation
    d. None of the above
    Answer: b. Sensitive data exposureplacementpreparation
26. How can “insecure deserialization” affect an application?
    a. It can enable arbitrary code execution
    b. Application runs faster
    c. Input is more secure
    d. Logging improves
    Answer: a. It can enable arbitrary code executiontestbook
27. Exposing unnecessary services or ports leads to which vulnerability?
    a. Security Misconfiguration
    b. Injection
    c. Broken Authentication
    d. Data encryption
    Answer: a. Security Misconfigurationtestbook
28. Which HTTP header prevents a browser from loading resources from untrusted domains?
    a. Content-Type
    b. Content-Security-Policy
    c. Location
    d. Date
    Answer: b. Content-Security-Policyqaautomation
29. Which two factors are required for two-factor authentication to be effective?
    a. Both come from the same category
    b. Two independent categories
    c. Two passwords
    d. Two PINs
    Answer: b. Two independent categoriessanfoundry
30. Which protocol is commonly exploited if session IDs are predictable?
    a. HTTP
    b. SFTP
    c. SSH
    d. None of the above
    Answer: a. HTTPsanfoundry+1
31. Which term describes an attack where untrusted data is executed as code?
    a. SQL Injection
    b. Cross-Site Scripting
    c. Code Injection
    d. Buffer Overflow
    Answer: c. Code Injectiontestbook
32. Which risk occurs when sensitive data is sent over plain HTTP?
    a. Data confidentiality
    b. Session management
    c. Error logging
    d. Insecure data transmission
    Answer: d. Insecure data transmissionsisainfosec+1
33. Which cookie attribute ensures cookies aren’t sent over unencrypted connections?
    a. Secure
    b. HttpOnly
    c. Domain
    d. Path
    Answer: a. Secureqaautomation
34. Why should error messages be generic?
    a. They improve user experience
    b. They help attackers
    c. To prevent information leakage
    d. Increase code complexity
    Answer: c. To prevent information leakageplacementpreparation
35. Which of the following is a risk with hardcoded credentials in applications?
    a. Administrative convenience
    b. Increased vulnerability to attacks
    c. Higher performance
    d. Data redundancy
    Answer: b. Increased vulnerability to attacksallabouttesting
36. What is “clickjacking”?
    a. A method to hide malicious code
    b. A way to manipulate users into clicking hidden UI elements
    c. Encrypting backup files
    d. Replacing website content
    Answer: b. A way to manipulate users into clicking hidden UI elementsqaautomation
37. Which process can identify code-level vulnerabilities during development?
    a. Dynamic Analysis
    b. Static Code Analysis
    c. Data Backup
    d. Penetration Testing
    Answer: b. Static Code Analysissisainfosec
38. What happens if session tokens aren’t renewed after privilege escalation?
    a. Improved security
    b. Token predictability
    c. Session fixation attacks
    d. Load balancing
    Answer: c. Session fixation attackstestbook
39. Cross-Site Scripting can be mitigated by:
    a. Accepting all user input
    b. Input validation and output encoding
    c. Disabling anti-virus
    d. Using HTTP only
    Answer: b. Input validation and output encodingqaautomation+1
40. What attack exploits the trust a site has in user’s browser?
    a. Cross-site Request Forgery (CSRF)
    b. Brute force login
    c. Social engineering
    d. Man-in-the-middle
    Answer: a. Cross-site Request Forgery (CSRF)testbook
41. Which of the following is a consequence of not updating libraries in web apps?
    a. Improved performance
    b. Using components with known vulnerabilities
    c. Better user tracking
    d. HTTP request flooding
    Answer: b. Using components with known vulnerabilitiestestbook
42. How should sensitive configuration files be protected?
    a. Naming them “secret”
    b. Disabling logging
    c. Restricting file permissions
    d. Moving to a cloud provider
    Answer: c. Restricting file permissionssisainfosec+1
43. What is the risk of not invalidating sessions after logout?
    a. Data redundancy
    b. Session hijacking
    c. New session creation
    d. Improved performance
    Answer: b. Session hijackingqaautomation+1
44. What does the principle of least privilege mean?
    a. Restrict access to only those who need it
    b. Grant admin rights to all users
    c. Use static IP addresses
    d. Enable debug mode
    Answer: a. Restrict access to only those who need itsisainfosec
45. Which of the following is NOT one of the OWASP Top 10 (2021)?
    a. Insecure Design
    b. Security Misconfiguration
    c. Phishing
    d. Sensitive Data Exposure
    Answer: c. Phishingallabouttesting+1
46. An application accepting serialized objects from untrusted sources faces which risk?
    a. Brute force
    b. Insecure Deserialization
    c. SQL Injection
    d. Secure Configuration
    Answer: b. Insecure Deserializationtestbook
47. Which is the best method for verifying user identity during session handling?
    a. Trusting user cookies
    b. Multi-factor authentication
    c. Using only IP address
    d. Accepting all logins
    Answer: b. Multi-factor authenticationsanfoundry+1
48. Which vulnerability could result if sensitive data is exposed in URL parameters?
    a. HTML Injection
    b. Sensitive Data Exposure
    c. Denial of service
    d. Cross-site scoring scripting
    Answer: b. Sensitive Data Exposuresisainfosec+1
49. What can result from using outdated or unsupported software components?
    a. Insecure defaults
    b. Using components with known vulnerabilities
    c. Secure configuration
    d. Dynamic analysis
    Answer: b. Using components with known vulnerabilitiessisainfosec+1
50. What is the risk if application errors are sent unfiltered to users?
    a. Data encryption
    b. Information leakage
    c. Performance boost
    d. Fewer logs
    Answer: b. Information leakageplacementpreparation

1. https://www.sanfoundry.com/database-mcqs-application-security/
2. https://testbook.com/objective-questions/mcq-on-owasp-top-10-vulnerabilities–5eea6a0d39140f30f369e30b
3. https://www.sisainfosec.com/blogs/5-most-common-application-vulnerabilities-and-how-to-mitigate-them/
4. https://qaautomation.expert/2025/03/04/multiple-choice-questions-for-security-testing-on-web-application/
5. https://allabouttesting.org/owasp-top-10-mcq-with-answers/
6. https://www.koenig-solutions.com/advanced-web-application-security-testing-quiz-questions-answers
7. https://www.placementpreparation.io/mcq/cyber-security/page/2/
8. https://www.sanfoundry.com/1000-cyber-security-questions-answers/
9. https://pdearmacs.edu.in/CyberSecurity/41_MCQ’s%20with%20Solutions.pdf
10. https://www.igmguru.com/blog/cyber-security-mcqs
11. https://www.sanfoundry.com/owasp-questions-answers/
12. https://gtu-mcq.com/BE/Computer-Engineering/Semester-5/3150714/1042/MCQs?q=9aZHDjblmRk%3D
13. https://www.scribd.com/document/488601324/Cyber-security-MCQ-NOTES
14. https://www.indusface.com/blog/application-bullet-proof-take-quiz/
15. https://www.scribd.com/document/861544872/OWASP-MCQ
16. https://timoh6.github.io/WebAppSecQuiz/
17. https://www.theknowledgeacademy.com/blog/cyber-security-mcq-and-answers/
18. https://www.vinsys.com/blog/top-30-mcqs-ceh-exam-preparation
19. https://wayground.com/admin/quiz/677f981e2abb06cdb2d13eea/application-security-quiz
20. https://www.studocu.com/in/document/amity-university/basics-of-acting/1-mcq/4315595