CVA CVA Web Application & API Security 2

Question 1

Which attack technique involves embedding malicious SQL code in input fields to manipulate database queries?

Accepted Answer

SQL Injection

Answer

SQL Injection involves inserting or 'injecting' malicious SQL statements into an entry field to manipulate the backend database.

Question 2

During API security testing, what does 'excessive data exposure' mean in the context of OWASP API Security Top 10?

Accepted Answer

APIs returning more data than the client needs, relying on clients to filter sensitive fields

Answer

Excessive data exposure occurs when an API returns full data objects and relies on the client to filter sensitive information, rather than the API itself controlling output.

Question 3

What type of vulnerability exists when a web application processes XML input that includes references to external entities?

Accepted Answer

XML External Entity (XXE) Injection

Answer

XXE injection exploits XML parsers that process external entity references, potentially allowing file disclosure, SSRF, or denial of service.

Question 4

Which technique is used to assess whether a web application properly invalidates session tokens after logout?

Accepted Answer

Post-logout token replay

Answer

Post-logout token replay tests whether a captured session token remains valid after the user logs out, verifying proper session invalidation.

Question 5

What is the significance of testing for HTTP security headers such as Content-Security-Policy during a web application assessment?

Accepted Answer

They instruct browsers on permitted content sources, reducing XSS and injection attack surfaces

Answer

Content-Security-Policy headers instruct browsers to only load resources from approved sources, significantly reducing the risk of XSS and data injection attacks.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA CVA Web Application & API Security 2