Practice Test Geeks(CVA) Certified Vulnerability Assessor Practice Test
← All CVA Flashcard Decks

CVA Web Application & API Security Flashcards

6 cards from real CVA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 CVA Web Application & API Security flashcards as text

  1. Which OWASP Top 10 vulnerability occurs when user-supplied input is included in a web page without proper sanitization, allowing scripts to execute in a victim's browser?

    Answer: Cross-Site Scripting (XSS)

    Cross-Site Scripting (XSS) occurs when unsanitized user input is reflected or stored in a web page, causing malicious scripts to execute in other users' browsers.

  2. During a web application assessment, you discover that changing the 'user_id' parameter in a GET request reveals another user's account data. Which vulnerability is this?

    Answer: Insecure Direct Object Reference (IDOR)

    IDOR occurs when an application exposes internal object references (such as user IDs) that can be manipulated to access unauthorized data.

  3. Which HTTP method should be tested during a web application vulnerability assessment to check for unintended server-side functionality exposure?

    Answer: PUT and DELETE

    PUT and DELETE methods can expose unintended server-side functionality such as file upload or deletion, and should always be tested during web assessments.

  4. What is the primary purpose of testing for Server-Side Request Forgery (SSRF) in a web application?

    Answer: To make the server perform requests to internal or external resources on behalf of the attacker

    SSRF allows attackers to coerce a server into making HTTP requests to internal services or external URLs, potentially exposing cloud metadata endpoints or internal networks.

  5. When assessing REST API security, which attack involves sending crafted JSON payloads to exploit parsing differences between services?

    Answer: JSON Interoperability Vulnerability

    JSON interoperability vulnerabilities exploit inconsistencies in how different JSON parsers handle duplicate keys or unexpected types, potentially bypassing security controls.

  6. Which tool is specifically designed to perform automated scanning of web application vulnerabilities including SQLi, XSS, and LFI?

    Answer: Nikto

    Nikto is an open-source web server scanner that checks for dangerous files, outdated software, and common vulnerabilities such as SQLi, XSS, and LFI.

How this page was made: written with AI tools. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. mile2.com — Test delivery, eligibility, retake policy, score validity, passing score, fees · verified Oct 2026