Cyber Security Application Security 1 — Questions and Answers
Question 1: What does OWASP stand for?
- Open Web Application Security Project (Correct answer)
- Organized Web Attack Security Protocol
- Online Vulnerability Assessment Security Platform
- Open Wireless Application Security Program
Correct answer: Open Web Application Security Project
OWASP stands for Open Web Application Security Project, a nonprofit foundation that publishes security guidance including the widely-used OWASP Top 10.
Question 2: Which attack type involves injecting malicious scripts into web pages viewed by other users?
- SQL Injection
- Cross-Site Scripting (XSS) (Correct answer)
- Cross-Site Request Forgery (CSRF)
- Command Injection
Correct answer: Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web pages, which then execute in victims' browsers to steal session tokens or redirect users.
Question 3: What is a SQL injection attack?
- Flooding a database server with requests to cause downtime
- Inserting malicious SQL code into input fields to manipulate database queries (Correct answer)
- Encrypting database contents to demand ransom
- Intercepting database traffic between client and server
Correct answer: Inserting malicious SQL code into input fields to manipulate database queries
SQL injection inserts malicious SQL statements into input fields, manipulating backend queries to expose, modify, or delete database data.
Question 4: What is Cross-Site Request Forgery (CSRF)?
- An attack that injects scripts to steal session cookies
- An attack that tricks authenticated users into unknowingly submitting malicious requests (Correct answer)
- An attack that forges TLS certificates to intercept traffic
- An attack that exploits weak passwords to access user accounts
Correct answer: An attack that tricks authenticated users into unknowingly submitting malicious requests
CSRF tricks an authenticated user's browser into sending an unintended request to a trusted site, exploiting the site's trust in the user's session.
Question 5: What is the primary purpose of input validation in application security?
- To improve application performance by caching user data
- To ensure user input conforms to expected formats and reject malicious data (Correct answer)
- To encrypt data before storing it in a database
- To log all user interactions for auditing purposes
Correct answer: To ensure user input conforms to expected formats and reject malicious data
Input validation ensures that only properly formed data enters the system, preventing injection attacks and other vulnerabilities caused by malformed or malicious input.
Question 6: What is a buffer overflow vulnerability?
- A condition where a network buffer becomes congested with too much traffic
- A flaw where a program writes more data to a buffer than it can hold, overwriting adjacent memory (Correct answer)
- A database error caused by exceeding the maximum field size
- A cryptographic weakness caused by reusing the same encryption key
Correct answer: A flaw where a program writes more data to a buffer than it can hold, overwriting adjacent memory
A buffer overflow occurs when a program writes data beyond the allocated buffer boundary, potentially overwriting adjacent memory and enabling attackers to execute arbitrary code.
Question 7: What is the purpose of a Content Security Policy (CSP) header?
- To enforce HTTPS connections across a website
- To restrict which sources browsers may load resources from, mitigating XSS attacks (Correct answer)
- To control which cookies are sent with cross-origin requests
- To rate-limit requests to protect against DDoS attacks
Correct answer: To restrict which sources browsers may load resources from, mitigating XSS attacks
CSP is an HTTP response header that allows servers to declare approved content sources, instructing browsers to only execute or render resources from those origins to reduce XSS risk.
Cyber Security Application Security 1
What does OWASP stand for?