Module 25 - Web Application Threats - Q&A

Question 1

Which of the following web application attacks are caused by compromising a vulnerable web site and uploading malicious code or using malicious links to get a user's sensitive information?
A. CSRF attack
B. XSS attack
C. Injection attack
D. Defacing attack

Answer 1

B. An XSS attack is caused by compromising a vulnerable web site and uploading malicious code or using malicious links to get a user’s sensitive information.

Question 2

Which of the following could make a web application vulnerable to an XSS attack? (Choose two.)
A. Weak encryption algorithm
B. Use of Flash, VBScript, or JavaScript
C. Malformed HTML requests
D. Malformed TCP segments

Answer 2

B. C. The use of Flash, VBScript, or JavaScript, as well as malformed HTML requests, can be used to create and execute XSS attacks.

Question 3

Which of the following are small files located on a host that contain session information about visited web sites?
A. Cookies
B. .html files
C. Session keys
D. Applets

Answer 3

A. Cookies are small files located on a host that contain session information about visited web sites.

Question 4

What types of applications do local shared objects support?
A. Java applets
B. Operating system executable files
C. Microsoft Office content
D. Adobe Flash content

Answer 4

D. Local shared objects support Adobe Flash content.

Question 5

All of the following are mitigations against HTML attachment attacks, except.
A. Stripping e-mail attachments containing HTML files
B. Encrypting HTML attachments during transmission
C. Preventing Internet connections from HTML attachments
D. Cautioning users not to click HTML attachments

Answer 5

B. Encrypting HTML attachments during transmission does not prevent HTML attachment attacks.

Question 6

Manipulating \_\_\_\_ is one way to embed malicious commands and directives into HTTP traffic sent back and forth between a client and web server.
A. request packets
B. response segments
C. HTTP headers
D. flash cookies

Answer 6

C. Manipulating HTTP headers is one way to embed malicious commands and directives into HTTP traffic sent back and forth between a client and web server.