Cyber Security Application Security 2

Question 1

Which OWASP Top 10 category refers to flaws that allow users to access resources or perform actions outside their intended permissions?

Accepted Answer

Broken Access Control

Answer

Security Misconfiguration

Answer

Cryptographic Failures

Answer

Insecure Design

Question 2

What is Server-Side Request Forgery (SSRF)?

Accepted Answer

An attack where the server is tricked into making requests to unintended internal or external resources

Answer

An attack that forges HTTP responses to inject malicious content into a browser

Answer

An attack that spoofs server certificates to perform man-in-the-middle interception

Answer

An attack that submits forged form data to bypass server-side validation

Question 3

What is XML External Entity (XXE) injection?

Accepted Answer

Exploiting XML parsers that process external entity references to access files or internal services

Answer

Injecting malicious XML tags to crash the XML parser

Answer

Forging XML digital signatures to bypass authentication

Answer

Using malformed XML to overflow a buffer in the parsing library

Question 4

What is insecure deserialization in application security?

Accepted Answer

Deserializing untrusted data that can lead to remote code execution or privilege escalation

Answer

Storing serialized objects in plain text without encryption

Answer

Failing to validate the format of JSON objects before storing them

Answer

Using weak hashing algorithms to sign serialized data

Question 5

What is the purpose of a Web Application Firewall (WAF)?

Accepted Answer

To filter and monitor HTTP traffic to detect and block common web attacks

Answer

To encrypt web traffic between the client and the server

Answer

To manage SSL/TLS certificates for web applications

Answer

To load-balance incoming web requests across multiple servers

Question 6

What is a path traversal (directory traversal) attack?

Accepted Answer

An attack using sequences like '../' to access files outside the intended web root

Answer

An attack that maps all available routes in a web application

Answer

An attack that redirects users to malicious URLs via open redirects

Answer

An attack that enumerates hidden directories through brute force

Question 7

What is security misconfiguration?

Accepted Answer

Insecure default settings, incomplete configurations, or unnecessary features left enabled in software

Answer

Using weak cryptographic algorithms in application code

Answer

Failing to patch known vulnerabilities in third-party libraries

Answer

Storing credentials in unencrypted configuration files