Certified Ethical Hacker Web Application Security 3

Question 1

Which OWASP Top 10 category covers broken authentication and session weaknesses?

Accepted Answer

Identification and Authentication Failures

Answer

Identification and Authentication Failures addresses weak login and session management.

Question 2

A directory traversal attack uses sequences like ../../ to:

Accepted Answer

Access files outside the web root

Answer

Path traversal navigates the filesystem to read files outside the intended directory.

Question 3

Server-Side Request Forgery (SSRF) is dangerous mainly because it can:

Accepted Answer

Make the server request internal resources

Answer

SSRF tricks the server into requesting internal services or cloud metadata endpoints.

Question 4

Which Content-Security-Policy directive helps mitigate XSS?

Accepted Answer

script-src

Answer

The script-src directive restricts which sources can execute scripts, reducing XSS impact.

Question 5

A web shell uploaded through an unrestricted file upload allows an attacker to:

Accepted Answer

Execute commands on the server

Answer

A web shell provides remote command execution on the compromised server.

Certified Ethical Hacker Practice Test