Certified Ethical Hacker Web Application Security 3

Question 1

Which OWASP Top 10 category covers broken authentication and session weaknesses?

Accepted Answer

Identification and Authentication Failures

Answer

Injection

Answer

Security Misconfiguration

Answer

Cryptographic Failures

Question 2

A directory traversal attack uses sequences like ../../ to:

Accepted Answer

Access files outside the web root

Answer

Encrypt files

Answer

Launch DoS attacks

Answer

Bypass CAPTCHA

Question 3

Server-Side Request Forgery (SSRF) is dangerous mainly because it can:

Accepted Answer

Make the server request internal resources

Answer

Deface a homepage

Answer

Steal browser cookies

Answer

Disable HTTPS

Question 4

Which Content-Security-Policy directive helps mitigate XSS?

Accepted Answer

script-src

Answer

Connection: keep-alive

Answer

Allow-Origin

Answer

max-age

Question 5

A web shell uploaded through an unrestricted file upload allows an attacker to:

Accepted Answer

Execute commands on the server

Answer

Only view images

Answer

Reset the database password

Answer

Send phishing emails only

Question 6

Which flag on a session cookie prevents it from being accessed by JavaScript?

Accepted Answer

HttpOnly

Answer

Secure

Answer

SameSite

Answer

Domain

Question 7

Blind SQL injection is identified primarily by:

Accepted Answer

Differences in true/false responses or timing

Answer

Verbose database errors

Answer

Stack traces in the browser

Answer

HTTP 500 every time