CVA CVA Web Application & API Security 2 — Questions and Answers
Question 1: Which attack technique involves embedding malicious SQL code in input fields to manipulate database queries?
- Cross-Site Request Forgery
- SQL Injection (Correct answer)
- Command Injection
- Path Traversal
Correct answer: SQL Injection
SQL Injection involves inserting or 'injecting' malicious SQL statements into an entry field to manipulate the backend database.
Question 2: During API security testing, what does 'excessive data exposure' mean in the context of OWASP API Security Top 10?
- Sending too many API requests
- APIs returning more data than the client needs, relying on clients to filter sensitive fields (Correct answer)
- Exposing API keys in URLs
- Allowing unrestricted file downloads
Correct answer: APIs returning more data than the client needs, relying on clients to filter sensitive fields
Excessive data exposure occurs when an API returns full data objects and relies on the client to filter sensitive information, rather than the API itself controlling output.
Question 3: What type of vulnerability exists when a web application processes XML input that includes references to external entities?
- SSRF
- XML External Entity (XXE) Injection (Correct answer)
- XPath Injection
- LDAP Injection
Correct answer: XML External Entity (XXE) Injection
XXE injection exploits XML parsers that process external entity references, potentially allowing file disclosure, SSRF, or denial of service.
Question 4: Which technique is used to assess whether a web application properly invalidates session tokens after logout?
- Password spraying
- Session fixation testing
- Post-logout token replay (Correct answer)
- Cookie poisoning
Correct answer: Post-logout token replay
Post-logout token replay tests whether a captured session token remains valid after the user logs out, verifying proper session invalidation.
Question 5: What is the significance of testing for HTTP security headers such as Content-Security-Policy during a web application assessment?
- They encrypt web traffic
- They instruct browsers on permitted content sources, reducing XSS and injection attack surfaces (Correct answer)
- They authenticate API consumers
- They enforce rate limiting on endpoints
Correct answer: They instruct browsers on permitted content sources, reducing XSS and injection attack surfaces
Content-Security-Policy headers instruct browsers to only load resources from approved sources, significantly reducing the risk of XSS and data injection attacks.
Question 6: During a web assessment, you identify that the application uses predictable tokens for password reset links. Which vulnerability category does this fall under?
- Broken Access Control
- Cryptographic Failures
- Security Misconfiguration
- Identification and Authentication Failures (Correct answer)
Correct answer: Identification and Authentication Failures
Predictable password reset tokens represent an Identification and Authentication Failure, as they allow attackers to guess or enumerate tokens and hijack account recovery.
CVA CVA Web Application & API Security 2
Which attack technique involves embedding malicious SQL code in input fields to manipulate database queries?