Security testing involves evaluating a computing system’s security features. This ensures they function properly. It also protects the application’s users and data.
| Chapter 1 What is Security Testing |
| Chapter 2 What is Security Testing in API? |
| Chapter 3 Understanding SQL Injection: Types and Prevention |
MCQ
Last Updated On
Welcome to the Security Testing on Web Application Quiz!
1) What is the primary goal of security testing in a web application?
a) To improve the user interface and user experience.
b) To identify and mitigate security vulnerabilities within the application.
c) To enhance the application’s performance and load times.
b) To identify and mitigate security vulnerabilities within the application.
2) By using relative XPath locators
2) What does the acronym ‘OWASP’ stand for?
a) Open Web Application Security Project
b) Open Worldwide Application Security Protocol
c) Offline Web Application Security Program
d) Operational Web Application Safety Procedure
a) Open Web Application Security Project
3) Which of the following is a common method hackers use to find vulnerabilities in web applications?
a) Social engineering
b) Penetration testing
c) Phishing
d) All of the above
d) All of the above
4) What is the primary goal of encryption in web applications?
a) To compress data
b) To increase data integrity
c) To secure data transmission and storage
d) To improve server performance
c) To secure data transmission and storage
5) What is the main risk of using default configurations for web applications?
a) Performance degradation
b) Increased vulnerability to attacks
c) Incompatibility with browsers
d) Accessibility issues
b) Increased vulnerability to attacks
6) What is the main function of a web application firewall (WAF)?
a) To block unauthorized access to the network
b) To filter and monitor HTTP traffic between a web application and the Internet
c) To encrypt data in transit
d) To detect and remove malware from user devices
b) To filter and monitor HTTP traffic between a web application and the Internet
WAFs are designed to defend against a variety of attacks that aim to exploit vulnerabilities in web applications, including:
– SQL Injection
– Cross-Site Scripting (XSS)
– Cross-Site Request Forgery (CSRF)
– File Inclusion
7) Which of the following HTTP headers is used to enhance security by declaring how browsers should handle site’s content?
a) Content-Type
b) Strict-Transport-Security
c) Content-Security-Policy
d) Cache-Control
c) Content-Security-Policy
It helps to prevent various types of attacks such as Cross-Site Scripting (XSS), clickjacking, and other code injection attacks by restricting resources like scripts, styles, or media from being loaded from unauthorized sources.
8) What is a common result of a successful buffer overflow attack?
a) Data leakage
b) Execution of arbitrary code
c) Network eavesdropping
d) Denial of service
b) Execution of arbitrary code
9) What does the term “privilege escalation” refer to in web application security?
a) The granting of highest-level access to all users
b) An attacker obtaining unauthorized higher-level privileges
c) The prioritization of security patches based on severity
d) Increasing the complexity of user authentication mechanisms
b) An attacker obtaining unauthorized higher-level privileges
10) What is the function of the HttpOnly attribute in a cookie?
a) To ensure cookies are only transferred over HTTPS
b) To limit cookies to the current session
c) To prevent access to cookies via JavaScript
d) To enable cross-domain cookie usage
c) To prevent access to cookies via JavaScript
11) Which of the following is implemented during secure session management to enhance security?
a) Storing sessions in browser local storage
b) Terminating sessions after a period of inactivity
c) Using random session IDs
d) b and c
d) b and c
12) Which type of attack is mitigated by setting the Secure attribute on cookies?
a) Clickjacking
b) SQL Injection
c) Man-in-the-middle (MitM) attack
d) Session hijacking over HTTP
2) Clickjacking
13) What type of attack exploits the trust a user has in a particular site?
a) Phishing
b) SQL Injection
c) Cross-Site Scripting (XSS)
d) Cross-Site Request Forgery (CSRF)
d) Cross-Site Request Forgery (CSRF)
14) What is Cross-Site Request Forgery (CSRF)?
a) A method to steal user cookies
b) A technique to redirect users to a malicious site
c) An attack that tricks the victim into submitting a malicious request
d) None of the above
c) An attack that tricks the victim into submitting a malicious request
15) Which security mechanism is designed to prevent CSRF (Cross-Site Request Forgery) attacks?
a) Input validation
b) Use of CSRF tokens
c) Secure cookies
d) Output encoding
b) Use of CSRF tokens
16) What is Cross-Site Scripting (XSS)?
a) A scripting language for web development
b) A technique to enhance website design
c) An attack where malicious scripts are injected into web pages
d) A secure communication protocol
c) An attack where malicious scripts are injected into web pages
17) Which of the following is NOT a type of cross-site scripting (XSS)?
a) Reflected XSS
b) Stored XSS
c) DOM-based XSS
d) Injection XSS
d) Injection XSS
18) What is a potential risk associated with insecure file uploads on a web application?
a) Improved user experience
b) Increased server performance
c) Remote code execution
d) Enhanced data integrity
c) Remote code execution
19) Which of the following is a best practice for password storage?
a) Storing passwords in plain text
b) Encrypting passwords using symmetric key encryption
c) Hashing passwords using a strong, one-way hashing algorithm with salt
d) Using passwords only for trusted users
c) Hashing passwords using a strong, one-way hashing algorithm with salt
20) What is the primary purpose of HTTPS?
a) To redirect users to the correct webpage
b) To improve website loading times
c) To encrypt data transmitted between the user’s browser and the web server
d) To block unwanted ads
c) To encrypt data transmitted between the user’s browser and the web server
21) Which HTTP header can be used to protect against clickjacking attacks?
a) Content-Security-Policy
b) X-Frame-Options
c) X-XSS-Protection
d) Strict-Transport-Security
b) X-Frame-Options
22) What is the purpose of content security policy (CSP)?
a) To prevent data breaches
b) To protect against XSS attacks
c) To enforce secure password handling
d) To block SQL injections
b) To protect against XSS attacks
23) Which protocol is designed to replace the widely exploited TELNET and offer encrypted communication?
a) HTTP
b) SSH
c) FTP
d) SMTP
b) SSH
24) Which OWASP tool is used primarily for penetration testing of web applications?
a) OWASP ZAP
b) Metasploit
c) Nmap
d) John the Ripper
a) OWASP ZAP
25) During a web application penetration test, what is the importance of session management testing?
a) To identify UI/UX issues
b) To ensure efficient data processing
c) To verify secure user session handling
d) To optimize web server performance
c) To verify secure user session handling
QA Automation Expert 