Web Development Security 5

Question 1

What is a race condition vulnerability in web applications?

Accepted Answer

Two concurrent requests exploit a window between a check and its enforcement, leading to unintended state changes

Answer

Race conditions (TOCTOU — Time-of-Check to Time-of-Use) occur when concurrent operations bypass security checks that assume sequential execution.

Question 2

Which of the following correctly describes a reflected XSS attack?

Accepted Answer

User input is immediately echoed back in the response without sanitization, executing in the victim's browser when they click a crafted link

Answer

Reflected XSS uses a crafted URL containing a script payload that the server reflects back in the response, requiring the victim to click the link.

Question 3

What is the purpose of a Web Application Firewall (WAF)?

Accepted Answer

To filter, monitor, and block malicious HTTP traffic targeting application-layer vulnerabilities

Answer

A WAF inspects HTTP requests and responses, applying rule sets to block common attacks like SQLi and XSS before they reach the application.

Question 4

Which security concept does 'defense in depth' describe?

Accepted Answer

Layering multiple independent security controls so that failure of one does not compromise the whole system

Answer

Defense in depth stacks multiple security layers (WAF, input validation, parameterized queries, least privilege) so attackers must defeat every layer.

Question 5

What is subdomain takeover and how can it occur?

Accepted Answer

A dangling DNS CNAME points to an unclaimed resource (e.g., deleted cloud bucket), allowing an attacker to claim that resource and serve content on the subdomain

Answer

Subdomain takeover occurs when a DNS entry points to a deprovisioned service; an attacker who claims that service can serve arbitrary content under the legitimate domain.

Web Development Practice Test

Web Development Practice Test

Web Development Security 5