Web Security Quiz

What is Cross-site scripting (XSS)?

• A method for encrypting data between a client and a server.

• A type of security vulnerability that allows attackers to inject malicious scripts into web applications.

• A technique used for compressing web content to improve loading times.

• A protocol for securely transmitting files over the internet.

Which of the following is NOT a type of XSS?

• Stored (Persistent) XSS

• Reflected (Non-Persistent) XSS

• DOM-based XSS

• Encrypted XSS

How does a Stored (Persistent) XSS attack work?

• The malicious script is temporarily stored in the user's browser cache.

• The malicious script is permanently stored on the target server and delivered to users.

• The malicious script is executed directly from an email attachment.

• The malicious script is reflected off a web server and executed immediately.

Which of the following is a common consequence of an XSS attack?

What is a key defense mechanism against XSS attacks?

• Enabling browser caching

• Using strong encryption algorithms

• Implementing Content Security Policy (CSP)

• Compressing web content

In a Reflected (Non-Persistent) XSS attack, where is the malicious script typically reflected from?

• The user's local storage

• The web server's response

• The user's operating system

• The network firewall

Which practice helps prevent XSS attacks by ensuring potentially harmful characters are rendered harmless when displayed in the browser?

• Input Validation

• Output Encoding

• Data Compression

• Network Encryption

DOM-based XSS vulnerabilities exist in which part of a web application?

• Server-side code

• Client-side code

• Network infrastructure

• Database schema

Which of the following is a recommended practice for preventing XSS attacks?

• Disabling JavaScript in the browser

• Encoding output and implementing input validation

• Storing all user input in plain text

• Allowing all scripts to run without restriction

What is the primary goal of an attacker using an XSS exploit?

• To improve the website's SEO ranking

• To steal sensitive information or compromise user accounts

• To increase the website's load speed

• To enhance the website's user interface