MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

What is the primary goal of a Cross-Site Request Forgery (CSRF) attack?
a. To improve website design
b. To force a user to perform unwanted actions without consent
c. To enhance server speed
d. To encrypt transmitted data
Answer: b.examradar
In a CSRF attack, what does the attacker usually exploit?
a. Man-in-the-middle attacks
b. An authenticated user session
c. Weak password policies
d. Server misconfiguration
Answer: b.examradar
How does CSRF differ from Cross-Site Scripting (XSS)?
a. CSRF injects scripts into web pages
b. XSS tricks users into submitting unwanted requests
c. CSRF causes users to perform unintended actions
d. XSS affects cookies directly
Answer: c.examradar
Which mechanism best prevents CSRF attacks?
a. SSL encryption
b. CAPTCHA authentication
c. Anti-CSRF tokens
d. URL encoding
Answer: c.examradar
The SameSite cookie attribute helps prevent CSRF by:
a. Allowing cross-site access by design
b. Restricting cookies to first-party contexts
c. Encrypting all cookies
d. Disabling session persistence
Answer: b.examradar
What is a major effect of a CSRF attack?
a. Disabling cookies
b. Unauthorized financial or account changes
c. Session expiration
d. Webpage defacement
Answer: b.examradar
A CSRF token must be:
a. Static and shared across users
b. Random and verified on the server
c. Visible to client-side scripts
d. Stored in cookies permanently
Answer: b.examradar
Validation of input data helps in:
a. Preventing script execution
b. Preventing CSRF and XSS
c. Speeding up the server
d. Hiding authentication data
Answer: b.examradar
A CSRF attack is more likely to succeed when:
a. The session cookie expires quickly
b. The browser automatically sends session cookies
c. Cookies use the HttpOnly flag
d. The site uses SameSite=Lax
Answer: b.geeksforgeeks
One common CSRF example is:
a. Changing user passwords without authorization
b. Injecting JavaScript into HTML
c. Evading encryption
d. Denying database access
Answer: a.geeksforgeeks
What role does a web browser play in a CSRF attack?
a. It prevents requests from being forged
b. It automatically includes authentication cookies
c. It encrypts headers
d. It blocks external links
Answer: b.geeksforgeeks
How do custom request headers mitigate CSRF?
a. By verifying origin on server side
b. By hiding request data
c. By randomizing cookies
d. By obfuscating URLs
Answer: a.examradar
What is the root cause of most CSRF vulnerabilities?
a. Missing output encoding
b. Session mismanagement and implicit authentication
c. Unsecured passwords
d. Open redirects
Answer: b.geeksforgeeks
In CSRF, what is a predictable request parameter?
a. Random token
b. Static value attacker can guess
c. Hidden dynamic field
d. Encrypted key
Answer: b.geeksforgeeks
Which HTTP method should not trigger state changes to avoid CSRF?
a. GET
b. POST
c. PUT
d. DELETE
Answer: a.geeksforgeeks
What is a Server-Side Request Forgery (SSRF)?
a. Injecting malicious JS
b. Manipulating the server to make requests on behalf of itself
c. Overwriting cookies client-side
d. Altering HTTP headers
Answer: b.examradar
What is the biggest security risk of SSRF?
a. Slower networking
b. Data loss from denial of service
c. Internal resource exposure
d. Client cache overflow
Answer: c.examradar
How can SSRF attacks access internal resources?
a. By manipulating URLs in server-side requests
b. By redirecting browsers
c. By installing malware
d. By DNS spoofing
Answer: a.examradar
What URL scheme is dangerous in SSRF?
a. ftp://
b. file://
c. data://
d. local://
Answer: b.examradar
What protection method prevents SSRF effectively?
a. URL whitelisting
b. Cookie encryption
c. Client encoding
d. HTML filtering
Answer: a.examradar
What happens if an SSRF request targets AWS metadata endpoints?
a. No risk
b. Unauthorized cloud credential exposure
c. Encryption failure
d. Browser crash
Answer: b.examradar
How do firewalls mitigate SSRF?
a. By logging IPs
b. By blocking access to internal network ranges
c. By encrypting cookies
d. By hashing data
Answer: b.examradar
Attackers can use SSRF for port scanning by:
a. Spoofing DNS entries
b. Requesting multiple internal ports
c. Flooding external servers
d. Disabling NAT
Answer: b.examradar
Which of the following best prevents SSRF vulnerabilities?
a. Validating user input URLs
b. Increasing thread control
c. Client-side sanitization only
d. Lengthening session time
Answer: a.examradar
What type of attack can SSRF escalate to?
a. Remote Code Execution
b. Denial of Service solely
c. SQL Injection
d. Buffer Overflow
Answer: a.geeksforgeeks
What internal resource might SSRF access?
a. Admin panels
b. Public APIs
c. JavaScript libraries
d. CDN servers
Answer: a.geeksforgeeks
SSRF can also be used to:
a. Steal internal credentials or tokens
b. Speed up resource caching
c. Reduce load balancing
d. Switch encryption algorithms
Answer: a.geeksforgeeks
Which HTTP feature makes SSRF possible?
a. Server-side URL fetch capability
b. Cookies
c. MIME types
d. CSP headers
Answer: a.geeksforgeeks
Cloud environments are vulnerable to SSRF mainly due to:
a. Metadata endpoints accessibility
b. DNS caching
c. Token expiration
d. Excessive logging
Answer: a.geeksforgeeks
Why are whitelists used in SSRF prevention?
a. To keep session data longer
b. To restrict external URLs to trusted destinations
c. To anonymize user IP
d. To reduce response size
Answer: b.examradar
What is a common SSRF vector?
a. Image fetching functionality
b. Browser caching
c. Session timeout
d. URL shortening
Answer: a.geeksforgeeks
What makes SSRF testing complex?
a. Lack of user interaction
b. Hidden internal routing
c. Missing logs
d. Short payloads
Answer: b.geeksforgeeks
SSRF attacks often originate from:
a. APIs fetching user-supplied resources
b. Client-side scripts
c. Browser redirects
d. Session cookies
Answer: a.portswigger
How can reverse proxies help block SSRF?
a. Validate external requests
b. Encrypt local storage
c. Disable token usage
d. Mask IP addresses
Answer: a.examradar
Which OWASP category includes SSRF?
a. Injection
b. Server-Side Request Forgery
c. Security Misconfiguration
d. Broken Access Control
Answer: b.testbook
In CSRF, one key indicator is:
a. Unintended user action via authenticated session
b. Repeated login prompts
c. Page redirection
d. Link aliasing
Answer: a.cloudflare
Which HTTP header helps detect CSRF origin?
a. Origin header
b. Cache-Control header
c. User-Agent header
d. Referrer-Policy header
Answer: a.examradar
Which web applications are high-risk for CSRF?
a. Stateful session apps
b. Static websites
c. Command-line utilities
d. Single-page dashboards
Answer: a.geeksforgeeks
Why must GET requests be kept idempotent?
a. It ensures CSRF-safe operations
b. It hides headers
c. It validates parameters
d. It blocks redirects
Answer: a.geeksforgeeks
What attack scenario blends SSRF and XXE vulnerabilities?
a. XML parser fetching local resources
b. SQL script injection
c. Command buffering
d. Cookie manipulation
Answer: a.examradar
What tool helps detect SSRF?
a. Burp Suite
b. Wireshark
c. Nmap
d. Shodan
Answer: a.portswigger
The common HTTP response to a failed SSRF request is:
a. 403 Forbidden
b. 404 Not Found
c. 500 Internal Error
d. 200 OK
Answer: c.portswigger
SSRF arises mainly when:
a. Servers trust user input URLs
b. Clients perform remote fetches
c. Browsers auto-submit forms
d. Firewalls misconfigure rules
Answer: a.geeksforgeeks
What happens if server input is unsanitized?
a. SSRF and input-based injection risks increase
b. Faster request handling
c. Increased authentication strength
d. Reduced cookie storage
Answer: a.geeksforgeeks
How can developers defend against both CSRF and SSRF?
a. Input validation and token verification
b. Disabling cookies
c. Allowing unrestricted access
d. Ignoring referrer headers
Answer: a.examradar+1
CSRF and SSRF both rely on:
a. Trust misuse in request handling
b. Buffer corruption
c. Credential rotation
d. Thread synchronization
Answer: a.geeksforgeeks+1
Which programming practice reduces request forgery risks?
a. Server-side validation only
b. Framework-integrated CSRF middleware
c. Static URL lists only
d. Client preprocessing
Answer: b.examradar
In modern browsers, SameSite cookies default to:
a. Lax
b. Strict
c. None
d. Open
Answer: a.fortinet
SSRF mitigation for APIs includes:
a. Disallow SSRF-prone schemas like file:// and gopher://
b. Allowing dynamic ports
c. Using unsafe redirects
d. Disabling all network calls
Answer: a.geeksforgeeks
Both CSRF and SSRF can ultimately result in:
a. Unauthorized actions or data exposure
b. Better caching
c. DNS optimization
d. API acceleration
Answer: a.geeksforgeeks+1

Blog

Systemethic Technologies

Leave a Reply Cancel reply

Useful links

Other Terms & Policies

Contact Info