E-Commerce Development Security 4

Question 1

A shopper receives an email appearing to be from your store asking them to re-enter credit card details via a link. What attack is this?

Accepted Answer

Phishing

Answer

Phishing uses fraudulent emails impersonating a trusted entity to steal sensitive information.

Question 2

What does the SameSite=Strict cookie attribute protect against?

Accepted Answer

Cross-Site Request Forgery (CSRF)

Answer

SameSite=Strict prevents cookies from being sent with cross-site requests, blocking CSRF attacks.

Question 3

Which technique do attackers use to bypass price validation by intercepting and modifying the checkout request before it reaches the server?

Accepted Answer

Parameter tampering

Answer

Parameter tampering involves modifying request parameters such as price or quantity using a proxy tool like Burp Suite.

Question 4

What is the recommended way to prevent insecure direct object references (IDOR) in an e-commerce order API?

Accepted Answer

Validate that the authenticated user owns the requested resource before returning it

Answer

Authorization checks must confirm the requesting user has permission to access the specific resource, not just that they are logged in.

Question 5

Which key management practice is critical when rotating encryption keys for stored payment tokens?

Accepted Answer

Re-encrypt existing data with the new key before decommissioning the old one

Answer

Existing encrypted data must be re-encrypted with the new key before the old key is destroyed to avoid data loss.

E-Commerce Development Practice Test