E-Commerce Development Security 2 — Questions and Answers
Question 1: Which HTTP header instructs browsers to only access a site over HTTPS for a specified duration?
- Content-Security-Policy
- Strict-Transport-Security (Correct answer)
- X-Frame-Options
- X-Content-Type-Options
Correct answer: Strict-Transport-Security
Strict-Transport-Security (HSTS) tells browsers to enforce HTTPS connections for the specified max-age period.
Question 2: An attacker intercepts the session cookie of a logged-in customer during an HTTP connection. What attack is this?
- CSRF
- SQL injection
- Session hijacking (Correct answer)
- Clickjacking
Correct answer: Session hijacking
Session hijacking occurs when an attacker steals a valid session token to impersonate an authenticated user.
Question 3: What does the 'secure' flag on a cookie do in an e-commerce application?
- Encrypts the cookie value
- Prevents JavaScript from reading the cookie
- Ensures the cookie is only sent over HTTPS (Correct answer)
- Limits the cookie to the same domain
Correct answer: Ensures the cookie is only sent over HTTPS
The Secure flag ensures the browser transmits the cookie only over encrypted HTTPS connections.
Question 4: Which PCI DSS requirement mandates that cardholder data must not be stored after transaction authorization unless necessary?
- Requirement 3 (Correct answer)
- Requirement 6
- Requirement 8
- Requirement 10
Correct answer: Requirement 3
PCI DSS Requirement 3 covers protection of stored cardholder data, including minimizing what is stored.
Question 5: A checkout form reflects user-entered search text directly in the page without encoding. What vulnerability exists?
- Stored XSS
- Reflected XSS (Correct answer)
- DOM-based XSS
- CSRF
Correct answer: Reflected XSS
Reflected XSS occurs when user input is immediately echoed back in the server response without proper encoding.
Question 6: Which cryptographic practice should be used to store customer passwords in an e-commerce database?
- MD5 hashing
- SHA-1 hashing
- AES encryption
- Bcrypt hashing with salt (Correct answer)
Correct answer: Bcrypt hashing with salt
Bcrypt with a unique salt is slow by design, making brute-force attacks computationally expensive.
Question 7: What security risk does an open redirect vulnerability introduce in an e-commerce site's login flow?
- Allows attackers to bypass authentication
- Enables phishing by redirecting users to malicious sites (Correct answer)
- Exposes session tokens in server logs
- Permits unauthorized file uploads
Correct answer: Enables phishing by redirecting users to malicious sites
Open redirects let attackers craft trusted-looking URLs that send users to phishing or malware sites.
E-Commerce Development Security 2
Which HTTP header instructs browsers to only access a site over HTTPS for a specified duration?