Certified Ethical Hacker Web Application Security 4

Question 1

Which attack abuses XML parsers that process external entity references?

Accepted Answer

XXE

Answer

CSRF

Answer

Clickjacking

Answer

Session fixation

Question 2

DOM-based XSS differs from reflected XSS because the payload is processed:

Accepted Answer

Entirely in the client-side JavaScript

Answer

Only on the server

Answer

By the database

Answer

By the firewall

Question 3

Session fixation is best prevented by:

Accepted Answer

Regenerating the session ID after login

Answer

Using long passwords

Answer

Disabling cookies

Answer

Caching pages

Question 4

Which command injection payload separator could chain an extra OS command?

Accepted Answer

; or |

Answer

--

Answer

/* */

Answer

%20

Question 5

What does the SameSite cookie attribute primarily defend against?

Accepted Answer

CSRF

Answer

SQL injection

Answer

XXE

Answer

Brute force

Question 6

An attacker enumerates valid usernames by observing different error messages. This is a flaw in:

Accepted Answer

Username enumeration / verbose feedback

Answer

Rate limiting

Answer

Encryption strength

Answer

TLS configuration

Question 7

Which header instructs browsers to enforce HTTPS for future visits?

Accepted Answer

Strict-Transport-Security

Answer

X-Content-Type-Options

Answer

Referrer-Policy

Answer

X-XSS-Protection