Web Development Security 5 — Questions and Answers
Question 1: What is a race condition vulnerability in web applications?
- Two concurrent requests exploit a window between a check and its enforcement, leading to unintended state changes (Correct answer)
- An attacker races to register a domain before the legitimate owner
- A server processes requests faster than the database can persist them
- Two browser tabs compete to read the same localStorage value
Correct answer: Two concurrent requests exploit a window between a check and its enforcement, leading to unintended state changes
Race conditions (TOCTOU — Time-of-Check to Time-of-Use) occur when concurrent operations bypass security checks that assume sequential execution.
Question 2: Which of the following correctly describes a reflected XSS attack?
- User input is immediately echoed back in the response without sanitization, executing in the victim's browser when they click a crafted link (Correct answer)
- Malicious JavaScript is stored in the database and served to all visitors
- JavaScript is injected into the DOM entirely on the client side without server involvement
- An attacker intercepts network traffic and injects script tags into HTTP responses
Correct answer: User input is immediately echoed back in the response without sanitization, executing in the victim's browser when they click a crafted link
Reflected XSS uses a crafted URL containing a script payload that the server reflects back in the response, requiring the victim to click the link.
Question 3: What is the purpose of a Web Application Firewall (WAF)?
- To filter, monitor, and block malicious HTTP traffic targeting application-layer vulnerabilities (Correct answer)
- To encrypt all traffic between the client and origin server
- To replace the need for input validation in application code
- To manage TLS certificates and terminate SSL at the network edge
Correct answer: To filter, monitor, and block malicious HTTP traffic targeting application-layer vulnerabilities
A WAF inspects HTTP requests and responses, applying rule sets to block common attacks like SQLi and XSS before they reach the application.
Question 4: Which security concept does 'defense in depth' describe?
- Layering multiple independent security controls so that failure of one does not compromise the whole system (Correct answer)
- Using the deepest available encryption algorithm for all data
- Hiding application implementation details from users
- Applying the most restrictive access controls at the perimeter
Correct answer: Layering multiple independent security controls so that failure of one does not compromise the whole system
Defense in depth stacks multiple security layers (WAF, input validation, parameterized queries, least privilege) so attackers must defeat every layer.
Question 5: What is subdomain takeover and how can it occur?
- A dangling DNS CNAME points to an unclaimed resource (e.g., deleted cloud bucket), allowing an attacker to claim that resource and serve content on the subdomain (Correct answer)
- An attacker hijacks DNS records by compromising the registrar account
- A subdomain's TLS certificate expires, making it accessible to anyone
- Cross-origin requests from a subdomain bypass the same-origin policy
Correct answer: A dangling DNS CNAME points to an unclaimed resource (e.g., deleted cloud bucket), allowing an attacker to claim that resource and serve content on the subdomain
Subdomain takeover occurs when a DNS entry points to a deprovisioned service; an attacker who claims that service can serve arbitrary content under the legitimate domain.
Question 6: In secure coding, what does 'parameterized queries' (prepared statements) prevent?
- SQL Injection by separating SQL code from user-supplied data so input is always treated as data, never as executable SQL (Correct answer)
- Path traversal by encoding special characters in file paths
- XSS by escaping HTML entities in query results
- CSRF by binding queries to a specific session token
Correct answer: SQL Injection by separating SQL code from user-supplied data so input is always treated as data, never as executable SQL
Parameterized queries send SQL structure and user data separately to the database driver, making it impossible for input to alter the query's logic.
Question 7: What is the Same-Origin Policy (SOP) in web browsers?
- A security mechanism that restricts scripts on one origin from reading resources from a different origin unless explicitly allowed (Correct answer)
- A rule that forces all resources on a page to load from the same server
- A policy that blocks all cross-site cookies regardless of domain
- A browser setting that prevents third-party JavaScript from executing
Correct answer: A security mechanism that restricts scripts on one origin from reading resources from a different origin unless explicitly allowed
SOP prevents malicious scripts on one origin (scheme + host + port) from accessing sensitive data from another origin, protecting user data across sites.
Web Development Security 5
What is a race condition vulnerability in web applications?