Certified Ethical Hacker Web Application Security 4

Question 1

Which attack abuses XML parsers that process external entity references?

Accepted Answer

XXE

Answer

XML External Entity (XXE) attacks exploit insecure XML parsers to read files or reach internal systems.

Question 2

DOM-based XSS differs from reflected XSS because the payload is processed:

Accepted Answer

Entirely in the client-side JavaScript

Answer

DOM-based XSS executes when client-side scripts write untrusted data into the DOM.

Question 3

Session fixation is best prevented by:

Accepted Answer

Regenerating the session ID after login

Answer

Issuing a new session ID upon authentication stops attackers from reusing a fixed one.

Question 4

Which command injection payload separator could chain an extra OS command?

Accepted Answer

; or |

Answer

Shell metacharacters like semicolon or pipe let attackers append additional commands.

Question 5

What does the SameSite cookie attribute primarily defend against?

Accepted Answer

CSRF

Answer

SameSite restricts cookies on cross-site requests, mitigating CSRF.

Certified Ethical Hacker Practice Test