CVA CVA Web Application & API Security

Question 1

Which OWASP Top 10 vulnerability occurs when user-supplied input is included in a web page without proper sanitization, allowing scripts to execute in a victim's browser?

Accepted Answer

Cross-Site Scripting (XSS)

Answer

Cross-Site Scripting (XSS) occurs when unsanitized user input is reflected or stored in a web page, causing malicious scripts to execute in other users' browsers.

Question 2

During a web application assessment, you discover that changing the 'user_id' parameter in a GET request reveals another user's account data. Which vulnerability is this?

Accepted Answer

Insecure Direct Object Reference (IDOR)

Answer

IDOR occurs when an application exposes internal object references (such as user IDs) that can be manipulated to access unauthorized data.

Question 3

Which HTTP method should be tested during a web application vulnerability assessment to check for unintended server-side functionality exposure?

Accepted Answer

PUT and DELETE

Answer

PUT and DELETE methods can expose unintended server-side functionality such as file upload or deletion, and should always be tested during web assessments.

Question 4

What is the primary purpose of testing for Server-Side Request Forgery (SSRF) in a web application?

Accepted Answer

To make the server perform requests to internal or external resources on behalf of the attacker

Answer

SSRF allows attackers to coerce a server into making HTTP requests to internal services or external URLs, potentially exposing cloud metadata endpoints or internal networks.

Question 5

When assessing REST API security, which attack involves sending crafted JSON payloads to exploit parsing differences between services?

Accepted Answer

JSON Interoperability Vulnerability

Answer

JSON interoperability vulnerabilities exploit inconsistencies in how different JSON parsers handle duplicate keys or unexpected types, potentially bypassing security controls.

(CVA) Certified Vulnerability Assessor Practice Test

(CVA) Certified Vulnerability Assessor Practice Test

CVA CVA Web Application & API Security