Cyber Security Application Security 2

Question 1

Which OWASP Top 10 category refers to flaws that allow users to access resources or perform actions outside their intended permissions?

Accepted Answer

Broken Access Control

Answer

Broken Access Control is the #1 OWASP risk and covers failures that allow users to act outside their intended privileges, such as accessing other users' accounts or unauthorized admin functions.

Question 2

What is Server-Side Request Forgery (SSRF)?

Accepted Answer

An attack where the server is tricked into making requests to unintended internal or external resources

Answer

SSRF manipulates a server into making HTTP requests to internal services or external systems on behalf of the attacker, potentially exposing cloud metadata or internal APIs.

Question 3

What is XML External Entity (XXE) injection?

Accepted Answer

Exploiting XML parsers that process external entity references to access files or internal services

Answer

XXE injection exploits XML parsers that resolve external entity declarations, allowing attackers to read local files, perform SSRF, or execute denial-of-service attacks.

Question 4

What is insecure deserialization in application security?

Accepted Answer

Deserializing untrusted data that can lead to remote code execution or privilege escalation

Answer

Insecure deserialization occurs when an application deserializes attacker-supplied data without validation, potentially allowing remote code execution, injection attacks, or privilege escalation.

Question 5

What is the purpose of a Web Application Firewall (WAF)?

Accepted Answer

To filter and monitor HTTP traffic to detect and block common web attacks

Answer

A WAF sits between web clients and servers to inspect HTTP traffic, identifying and blocking common attacks like SQLi, XSS, and CSRF based on defined rule sets.

Cyber Security Practice Test

Cyber Security Practice Test

Cyber Security Application Security 2