Web Programming Security Web Programming 5

Question 1

What is the purpose of subresource integrity (SRI) when loading third-party scripts?

Accepted Answer

It verifies that a fetched resource matches an expected cryptographic hash

Answer

SRI lets browsers verify that a CDN-hosted resource hasn't been tampered with by checking its content against a hash in the integrity attribute.

Question 2

A session cookie lacks the `HttpOnly` flag. What attack does this enable?

Accepted Answer

JavaScript reading the cookie via XSS

Answer

Without HttpOnly, JavaScript (including injected XSS payloads) can access the cookie via document.cookie, enabling session hijacking.

Question 3

Which OWASP category covers misconfigured cloud storage buckets left publicly readable?

Accepted Answer

A05 Security Misconfiguration

Answer

Publicly accessible cloud buckets are a classic security misconfiguration — default settings left insecure rather than hardened.

Question 4

What does 'defense in depth' mean in web security?

Accepted Answer

Layering multiple independent security controls so no single failure compromises the system

Answer

Defense in depth layers controls (WAF, input validation, parameterized queries, least privilege) so that bypassing one layer doesn't give full access.

Question 5

An attacker intercepts an HTTPS session by presenting a forged certificate. What attack is this?

Accepted Answer

Man-in-the-middle (MITM) attack

Answer

A MITM attack positions the attacker between client and server, often by using a forged TLS certificate to decrypt and re-encrypt traffic.

Web Programming Practice Test

Web Programming Practice Test

Web Programming Security Web Programming 5