Certified Ethical Hacker Web Application Security 3 — Questions and Answers
Question 1: Which OWASP Top 10 category covers broken authentication and session weaknesses?
- Injection
- Identification and Authentication Failures (Correct answer)
- Security Misconfiguration
- Cryptographic Failures
Correct answer: Identification and Authentication Failures
Identification and Authentication Failures addresses weak login and session management.
Question 2: A directory traversal attack uses sequences like ../../ to:
- Encrypt files
- Access files outside the web root (Correct answer)
- Launch DoS attacks
- Bypass CAPTCHA
Correct answer: Access files outside the web root
Path traversal navigates the filesystem to read files outside the intended directory.
Question 3: Server-Side Request Forgery (SSRF) is dangerous mainly because it can:
- Deface a homepage
- Make the server request internal resources (Correct answer)
- Steal browser cookies
- Disable HTTPS
Correct answer: Make the server request internal resources
SSRF tricks the server into requesting internal services or cloud metadata endpoints.
Question 4: Which Content-Security-Policy directive helps mitigate XSS?
- script-src (Correct answer)
- Connection: keep-alive
- Allow-Origin
- max-age
Correct answer: script-src
The script-src directive restricts which sources can execute scripts, reducing XSS impact.
Question 5: A web shell uploaded through an unrestricted file upload allows an attacker to:
- Only view images
- Execute commands on the server (Correct answer)
- Reset the database password
- Send phishing emails only
Correct answer: Execute commands on the server
A web shell provides remote command execution on the compromised server.
Question 6: Which flag on a session cookie prevents it from being accessed by JavaScript?
- Secure
- HttpOnly (Correct answer)
- SameSite
- Domain
Correct answer: HttpOnly
The HttpOnly flag blocks JavaScript access, mitigating cookie theft via XSS.
Question 7: Blind SQL injection is identified primarily by:
- Verbose database errors
- Differences in true/false responses or timing (Correct answer)
- Stack traces in the browser
- HTTP 500 every time
Correct answer: Differences in true/false responses or timing
Blind SQLi infers data from boolean response changes or time delays, without direct output.
Certified Ethical Hacker Web Application Security 3
Which OWASP Top 10 category covers broken authentication and session weaknesses?