E-Commerce Development Security 4 — Questions and Answers
Question 1: A shopper receives an email appearing to be from your store asking them to re-enter credit card details via a link. What attack is this?
- Pharming
- Phishing (Correct answer)
- Vishing
- Smishing
Correct answer: Phishing
Phishing uses fraudulent emails impersonating a trusted entity to steal sensitive information.
Question 2: What does the SameSite=Strict cookie attribute protect against?
- XSS attacks
- SQL injection
- Cross-Site Request Forgery (CSRF) (Correct answer)
- Session fixation
Correct answer: Cross-Site Request Forgery (CSRF)
SameSite=Strict prevents cookies from being sent with cross-site requests, blocking CSRF attacks.
Question 3: Which technique do attackers use to bypass price validation by intercepting and modifying the checkout request before it reaches the server?
- SQL injection
- Parameter tampering (Correct answer)
- DNS spoofing
- ARP poisoning
Correct answer: Parameter tampering
Parameter tampering involves modifying request parameters such as price or quantity using a proxy tool like Burp Suite.
Question 4: What is the recommended way to prevent insecure direct object references (IDOR) in an e-commerce order API?
- Use sequential IDs
- Validate that the authenticated user owns the requested resource before returning it (Correct answer)
- Encrypt all response bodies
- Require HTTPS for all endpoints
Correct answer: Validate that the authenticated user owns the requested resource before returning it
Authorization checks must confirm the requesting user has permission to access the specific resource, not just that they are logged in.
Question 5: Which key management practice is critical when rotating encryption keys for stored payment tokens?
- Delete the old key immediately after rotation
- Re-encrypt existing data with the new key before decommissioning the old one (Correct answer)
- Generate the new key from the old key
- Store both keys in the same secrets manager entry
Correct answer: Re-encrypt existing data with the new key before decommissioning the old one
Existing encrypted data must be re-encrypted with the new key before the old key is destroyed to avoid data loss.
Question 6: An e-commerce site logs full credit card numbers in its application error log. Which PCI DSS requirement does this violate?
- Requirement 1 — network firewall
- Requirement 3 — protect stored cardholder data (Correct answer)
- Requirement 7 — restrict access by need to know
- Requirement 12 — information security policy
Correct answer: Requirement 3 — protect stored cardholder data
PCI DSS Requirement 3 prohibits storing sensitive authentication data including full card numbers in logs.
Question 7: What is the role of a nonce in a Content-Security-Policy script-src directive?
- It encrypts inline scripts
- It allows specific trusted inline scripts while blocking all others (Correct answer)
- It compresses script payloads
- It generates a CSRF token for forms
Correct answer: It allows specific trusted inline scripts while blocking all others
A per-request cryptographic nonce in the CSP header allows only scripts tagged with that nonce to execute.
E-Commerce Development Security 4
A shopper receives an email appearing to be from your store asking them to re-enter credit card details via a link.
What attack is this?