E-Commerce Development Security 2

Question 1

Which HTTP header instructs browsers to only access a site over HTTPS for a specified duration?

Accepted Answer

Strict-Transport-Security

Answer

Strict-Transport-Security (HSTS) tells browsers to enforce HTTPS connections for the specified max-age period.

Question 2

An attacker intercepts the session cookie of a logged-in customer during an HTTP connection. What attack is this?

Accepted Answer

Session hijacking

Answer

Session hijacking occurs when an attacker steals a valid session token to impersonate an authenticated user.

Question 3

What does the 'secure' flag on a cookie do in an e-commerce application?

Accepted Answer

Ensures the cookie is only sent over HTTPS

Answer

The Secure flag ensures the browser transmits the cookie only over encrypted HTTPS connections.

Question 4

Which PCI DSS requirement mandates that cardholder data must not be stored after transaction authorization unless necessary?

Accepted Answer

Requirement 3

Answer

PCI DSS Requirement 3 covers protection of stored cardholder data, including minimizing what is stored.

Question 5

A checkout form reflects user-entered search text directly in the page without encoding. What vulnerability exists?

Accepted Answer

Reflected XSS

Answer

Reflected XSS occurs when user input is immediately echoed back in the server response without proper encoding.

E-Commerce Development Practice Test