E-Commerce Development Security 5

Question 1

Which attack targets the build pipeline of an e-commerce platform by injecting malicious code into a third-party npm package it depends on?

Accepted Answer

Supply chain attack

Answer

Supply chain attacks compromise upstream dependencies to deliver malicious code to all downstream consumers.

Question 2

What is subresource integrity (SRI) used for in e-commerce front-end development?

Accepted Answer

Verifying that CDN-served scripts have not been tampered with

Answer

SRI uses a cryptographic hash in the script tag to ensure the fetched file matches the expected content.

Question 3

A bot repeatedly attempts to redeem single-use discount codes on your checkout. What control best mitigates this?

Accepted Answer

Implement rate limiting and CAPTCHA on the coupon redemption endpoint

Answer

Rate limiting restricts the number of attempts per IP or account, and CAPTCHA distinguishes bots from humans.

Question 4

Which TLS configuration flaw allows an attacker to downgrade a connection to an older vulnerable protocol version?

Accepted Answer

Allowing TLS 1.0 or 1.1 on the server

Answer

If the server still supports TLS 1.0 or 1.1, attackers can force a protocol downgrade exploiting known vulnerabilities.

Question 5

What is the difference between authentication and authorization in an e-commerce API context?

Accepted Answer

Authentication verifies who the caller is; authorization determines what they are allowed to do

Answer

Authentication confirms identity while authorization enforces permissions on what resources can be accessed.

E-Commerce Development Practice Test