LO1 SR

Encrypting data with SSL will not guarantee the safety of a website, because:

• This only protects data between the website and user, not the Web application itself.

• This approach ignores the security of the software on the network or Web server.

• This only protects data transmitted through port 443.

• The encryption used by SSL is not strong.

What is another term for DAST?

• White box testing.

• Black box testing.

• Glass box testing.

• Gray box testing.

What type of attack target a website’s method of validating the identity of a user?

• Authorization.

• Authentication

• Identity attack.

• client-side attack.

Which HTTP method sends data to the server?

• GET

• POST

• PUT

• SEND

A hacker enters the following script into the search box or an entry form: <Script>’t

Worked”</Script>. The hacker then clicks the search button and a pop-up window appears stating It Worked. What you conclude from this?

• The site is susceptible to buffer overflow

• The site is susceptible to SQL injection

• The site is susceptible to parameter tampering

• The site is susceptible to XSS

In electronic authentication, which of the following controls is effective against cross-site scripting (XSS) vulnerabilities?

• Sanitize inputs to make them non executable.

• Insert random data into any linked uniform resource locator

• Insert random data into a hidden field

• Use a per-session shared secret

CSRF stands for

• Cross State Request Forgery.

• Cross Site Reply Forgery.

• Cross Site Request Forgery.

• Cross State Reply Forgery.

Select a correct answer on how to protest a website from becoming the victim of CSRF attack.

• Insert sequence tokens in to the forms and URLs used in transactions.

• Use only post method while sending sensitive data to web server

• Don’t set up external verification mechanism.

• Restrict checking user authentication.

Which is not considered as a weak authentication?

• Allowing single words like names as password.

• Allowing multiple login attempt for invalid login.

• Keeping birthday as password.

• Not allowing users to use the previous password.

What is session hijacking?

• It is an attackers steals a web session through session ID of victim

• A well-managed session ID is called session hijacking.

• Storing the sensitive information in the cookies is called session hijacking.

• Displaying the session ID in the browser is called session hijacking