MCQs

Disclaimer:

Educational Use Only:

The website links provided are to be used strictly for educational and knowledge-gaining purposes only.

No Misuse:

Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.

Respect for Websites and Businesses:

Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.

Acknowledge Value of Knowledge:

Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.

No Endorsement:

The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.

User Responsibility:

By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.

Which vulnerability allows an attacker to inject malicious SQL commands into a web application’s database?
a. Cross-Site Scripting
b. SQL Injection
c. CSRF
d. XML Injection
Answer: b. SQL Injectionjanbasktraining+2
What is the main risk of Cross-Site Scripting (XSS) in web applications?
a. Data encryption
b. Session hijacking
c. Buffer overflow
d. Phishing attacks
Answer: b. Session hijackingtestbook+2
Which vulnerability allows an attacker to trick a user’s browser into submitting a request to a site where the user is authenticated?
a. Session Fixation
b. Cross-Site Request Forgery (CSRF)
c. SQL Injection
d. Path Traversal
Answer: b. Cross-Site Request Forgery (CSRF)webasha+2
What is the result of insecure deserialization in web applications?
a. Privilege escalation
b. Arbitrary code execution
c. Clickjacking
d. Open redirect
Answer: b. Arbitrary code executiondocsity+2
Which of the following attacks is most likely if a web application fails to escape user input when generating HTML?
a. Cross-Site Scripting
b. CSRF
c. SQL Injection
d. Brute force
Answer: a. Cross-Site Scriptingjanbasktraining+2
Which vulnerability occurs when user input is used to construct file paths without validation?
a. Remote Code Execution
b. Local File Inclusion (LFI)
c. Server-Side Request Forgery
d. Session Hijacking
Answer: b. Local File Inclusion (LFI)docsity+1
Which one is a main difference between Local File Inclusion (LFI) and Remote File Inclusion (RFI)?
a. LFI is only for Windows
b. RFI includes files from external sources
c. LFI is more dangerous
d. Both are the same
Answer: b. RFI includes files from external sourcesdocsity
Insecure Direct Object Reference (IDOR) in web applications is a type of:
a. Authorization flaw
b. Authentication flaw
c. Cookie flaw
d. Injection flaw
Answer: a. Authorization flawtib3rius+1
Which vulnerability involves an attacker injecting malicious XML data into a parser?
a. XXE
b. XSS
c. CSRF
d. RFI
Answer: a. XXE (XML External Entity attack)testbook+1
Which HTTP header can help protect against clickjacking attacks?
a. Content-Type
b. X-Frame-Options
c. Access-Control-Allow-Origin
d. Set-Cookie
Answer: b. X-Frame-Optionsexamradar+1
What is a common sign of a Broken Authentication vulnerability?
a. Passwords sent as hashes
b. Unrestricted session ID usage
c. Input validation on forms
d. Use of HTTPS
Answer: b. Unrestricted session ID usagevinsys+1
What technique can mitigate SQL Injection?
a. Password complexity
b. Parameterized queries
c. Content Security Policy
d. Secure cookies
Answer: b. Parameterized querieswebasha+2
What is the impact of Security Misconfiguration in web applications?
a. Slow app performance
b. Data exposure
c. Increased user privacy
d. Reduced network latency
Answer: b. Data exposuretib3rius+2
Which is NOT a type of Cross-Site Scripting (XSS)?
a. Reflected
b. Stored
c. DOM-based
d. Transitive
Answer: d. Transitivetestbook+1
What does the “A” in OWASP top-10 “A01:2021” stand for?
a. Authentication
b. Access Control
c. Injection
d. Broken Access Control
Answer: d. Broken Access Controlexamradar+1
What type of attack exploits improper validation of input data in JSON APIs?
a. SQL Injection
b. Server-Side Request Forgery
c. JSON Injection
d. LDAP Injection
Answer: c. JSON Injectionjanbasktraining+1
Which vulnerability allows attackers to execute arbitrary commands on the host OS via an application?
a. Command Injection
b. XSS
c. CSRF
d. IDOR
Answer: a. Command Injectionwebasha+2
What is the result of improper implementation of authentication and session management?
a. Strong encryption
b. Unauthorized access
c. Network segmentation
d. Regular updates
Answer: b. Unauthorized accessvinsys+1
Which type of vulnerability is exploited by mixing trusted and untrusted data in SQL queries?
a. Path Traversal
b. SQL Injection
c. File Inclusion
d. Race Condition
Answer: b. SQL Injectionjanbasktraining+1
Which HTTP header can mitigate XSS attacks?
a. Content-Security-Policy
b. X-Forwarded-For
c. Keep-Alive
d. X-Powered-By
Answer: a. Content-Security-Policytestbook+1
A web app that stores sensitive information in plain text is exposed to:
a. Information disclosure
b. Open redirection
c. CSRF
d. XSS
Answer: a. Information disclosureexamradar+2
What can best prevent insecure deserialization?
a. Blacklisting data types
b. Serializing only trusted data
c. Weak session tokens
d. Using HTTP GET methods
Answer: b. Serializing only trusted datavinsys+1
Which attack can occur if an application exposes details of internal implementation in error messages?
a. Information Disclosure
b. CSRF
c. XSS
d. Brute Force
Answer: a. Information Disclosureexamradar+1
What is the goal of an open redirection attack?
a. Deface the website
b. Redirect users to malicious sites
c. Bypass rate limiting
d. Steal cookies
Answer: b. Redirect users to malicious sitesdocsity+2
Which misconfiguration can lead to unauthorized access via default accounts?
a. Missing rate limiting
b. Default credentials
c. Input validation
d. Overzealous firewall
Answer: b. Default credentialswebasha+1
What is a primary risk if application logs are accessible to the internet?
a. Resource exhaustion
b. Data leakage
c. Domain hijacking
d. Cookie forgery
Answer: b. Data leakagetestbook+1
What is one prevention for Insecure Direct Object Reference?
a. Parameterized queries
b. Access control checks
c. Strong password policy
d. SSL certificates
Answer: b. Access control checkstib3rius+1
Which header prevents browsers from interpreting files as a different MIME type?
a. X-Content-Type-Options
b. X-Frame-Options
c. Set-Cookie
d. X-XSS-Protection
Answer: a. X-Content-Type-Optionsexamradar+1
What does input validation help prevent in web apps?
a. SQL Injection
b. CSRF
c. XSS
d. All of the above
Answer: d. All of the abovejanbasktraining+2
Which tool can help identify vulnerabilities in a web application automatically?
a. Manual code review
b. Vulnerability scanner
c. Wire transfer
d. Cookie parser
Answer: b. Vulnerability scannertechtarget+1
What is HTTP Parameter Pollution (HPP)?
a. Combining cookies
b. Tampering with URL parameters
c. Manipulating HTTP headers
d. Overloading POST requests
Answer: b. Tampering with URL parameterstib3rius
What is the impact of brute-forcing login pages?
a. Session hijacking
b. Account lockouts or compromise
c. Directory traversal
d. XSS
Answer: b. Account lockouts or compromiseexamradar+1
Which vulnerability allows an attacker to read internal files via user-submitted URLs?
a. RFI
b. LFI
c. CSRF
d. SSRF
Answer: d. SSRFjanbasktraining+1
What attack uses browser autofill functionality to steal credentials?
a. Autofill attack
b. Phishing
c. CSRF
d. XSS
Answer: a. Autofill attacktestbook+1
Which security control mitigates replay attacks in web applications?
a. Nonce
b. Parameter tampering
c. Weak session IDs
d. Excessive logging
Answer: a. Nonceexamradar+1
What is the risk of including third-party scripts from untrusted sources?
a. File inclusion
b. Supply chain attacks
c. Buffer overflow
d. Race condition
Answer: b. Supply chain attackswebasha+1
Which mechanism can detect unusual web traffic patterns indicating an attack?
a. Web Application Firewall
b. Content Delivery Network
c. Load balancer
d. URL encoding
Answer: a. Web Application Firewalltechtarget+1
What is a common mitigation for clickjacking?
a. SameSite cookie attribute
b. X-Frame-Options header
c. CSRF token
d. CSP
Answer: b. X-Frame-Options headertestbook+1
What can a session fixation attack allow?
a. Stealing session cookies
b. Bypassing file permissions
c. Overwriting logs
d. Bypass SSL
Answer: a. Stealing session cookiesvinsys+1
The primary cause of path traversal vulnerabilities is:
a. Weak input validation
b. Strong encryption
c. Disabling cookies
d. Rate limiting
Answer: a. Weak input validationdocsity+2
Which of the following best defines Broken Access Control?
a. Failing to enforce permissions
b. Revealing server software version
c. Not using HTTPS
d. Allowing unsigned cookies
Answer: a. Failing to enforce permissionsexamradar+1
What is a risk of hardcoded API keys in client-side code?
a. Log poisoning
b. Credentials exposure
c. XSS
d. CSRF
Answer: b. Credentials exposurewebasha+1
DOM Clobbering can result in what type of attack?
a. XSS
b. CSRF
c. SQL Injection
d. Man-in-the-middle
Answer: a. XSStib3rius
Which vulnerability is exploited when a web server allows uploading of executable files?
a. File upload vulnerability
b. Command injection
c. LFI
d. Buffer overflow
Answer: a. File upload vulnerabilitydocsity+2
Which type of vulnerability does the Same-Origin Policy help prevent?
a. CSRF
b. XSS
c. IDOR
d. Directory traversal
Answer: a. CSRFjanbasktraining+2
What can be the consequence of weak password policies in web applications?
a. User enumeration
b. Account compromise
c. Input validation errors
d. Open redirection
Answer: b. Account compromisetestbook+1
Which of these is not a web application vulnerability?
a. DDoS
b. SQL Injection
c. XSS
d. CSRF
Answer: a. DDoSvinsys+1
Which framework provides a widely used Top 10 list for web vulnerabilities?
a. OWASP
b. NIST
c. CIS
d. ISO
Answer: a. OWASPexamradar+1
What is the security risk if an application trusts user-supplied file extensions?
a. Arbitrary file execution
b. Brute force
c. Weak authentication
d. Phishing
Answer: a. Arbitrary file executiondocsity+1
The first step in mitigating web application vulnerabilities is:
a. Regular vulnerability scanning
b. Using HTTP only
c. Allowing all user uploads
d. Redirecting all HTTP to HTTPS
Answer: a. Regular vulnerability scanningtechtarget+1

Blog

Systemethic Technologies

Leave a Reply Cancel reply

Useful links

Other Terms & Policies

Contact Info