Certified Ethical Hacker Web Application Security 2

Question 1

An attacker injects ' OR '1'='1 into a login form and gains access. Which vulnerability is exploited?

Accepted Answer

SQL Injection

Answer

The injected condition always evaluates true, bypassing authentication via SQL Injection.

Question 2

Which HTTP response header best mitigates clickjacking attacks?

Accepted Answer

X-Frame-Options

Answer

X-Frame-Options controls whether a page can be framed, preventing clickjacking.

Question 3

A stored XSS payload is most dangerous because it:

Accepted Answer

Executes for every user who views the data

Answer

Stored XSS persists on the server and runs for every victim who loads the page.

Question 4

Which technique best prevents SQL injection in application code?

Accepted Answer

Parameterized queries

Answer

Parameterized (prepared) statements separate code from data, neutralizing injection.

Question 5

An IDOR vulnerability typically allows an attacker to:

Accepted Answer

Access objects belonging to other users by changing an ID

Answer

Insecure Direct Object Reference lets users access unauthorized records by manipulating identifiers.

Certified Ethical Hacker Practice Test