SecQuiz -04

What type of attack involves sending spoofed requests to amplifiers to flood a victim

• SYN flood

• ICMP flood

• Reflection attack

• DNS poisoning

What does a SYN flood attack primarily exploit?

• Bandwidth limitations

• The DNS lookup process

• Vulnerable/Open TCP connections

• Authentication protocols

Which firewall rule strategy minimizes risk by default?

• Deny-lists

• Stateful inspection

• Allow-lists

• Protocol matching

What is the purpose of the Same-Origin Policy (SOP)?

• To enhance server-side security

• To allow cross-origin resource sharing

• To isolate documents from different origins

• To encrypt JavaScript files

Which of the following headers makes cookies inaccessible to JavaScript?

• Secure

• Expires

• HttpOnly

• Domain

What is the "PRIMARY" difference between Reflected and Persistent XSS?

• Reflected XSS requires user input; Persistent XSS does not

• Persistent XSS is more dangerous than Reflected XSS

• Persistent XSS stores payloads on the server; Reflected XSS does not

• Reflected XSS cannot steal cookies, but Persistent XSS can

What is the role of CSP in mitigating XSS?

• It blocks all JavaScript execution

• It prevents loading of untrusted scripts

• It sanitizes user inputs

• It replaces the Same-Origin Policy

What is a "KEY" characteristic of CSRF attacks?

• They exploit user session cookies

• They require the user to click malicious links

• They always involve JavaScript payloads

• They manipulate the browser cache

Why is referrer validation not a foolproof defense against CSRF?

• Referrer headers are not sent in POST requests

• Attackers can forge referrer headers

• Browsers may strip referrer headers

• It cannot validate HTTPS requests

What is the purpose of the strict-dynamic CSP directive?

• It prevents loading of inline scripts

• It disables nonce-based scripts

• It allows trusted scripts to create other scripts

• It allows only HTTPS requests