Web Development Security 2

Question 1

Which HTTP header prevents a browser from MIME-sniffing a response away from the declared content type?

Accepted Answer

X-Content-Type-Options: nosniff

Answer

X-Content-Type-Options: nosniff tells browsers to strictly follow the declared Content-Type and not guess the type from content.

Question 2

What is a Server-Side Request Forgery (SSRF) attack?

Accepted Answer

An attacker tricks the server into making HTTP requests to internal or external resources on their behalf

Answer

SSRF exploits a server to make requests to internal services or external URLs that the attacker cannot directly access.

Question 3

In OAuth 2.0, what is the purpose of the 'state' parameter?

Accepted Answer

To prevent CSRF attacks during the authorization flow

Answer

The 'state' parameter is a random value the client sends and verifies on return to prevent cross-site request forgery during OAuth flows.

Question 4

Which of the following is the PRIMARY risk of using MD5 to hash passwords?

Accepted Answer

MD5 is too fast, making brute-force and rainbow table attacks practical

Answer

MD5's speed allows attackers to compute billions of hashes per second, making password cracking via brute-force or precomputed tables feasible.

Question 5

What does the 'httpOnly' flag on a cookie do?

Accepted Answer

Prevents client-side JavaScript from accessing the cookie

Answer

The httpOnly flag blocks JavaScript's document.cookie API from reading the cookie, mitigating XSS-based session theft.

Web Development Practice Test