Web Security — Test 1

Correct Answer: C. Parameterized queries (prepared statements)
Explanation: Escaping input by hand is error-prone. HTTPS does not affect SQL injection at all. ALSO KNOW (related points): • Which HTTP header helps prevent clickjacking? → X-Frame-Options (or CSP frame-ancestors)

Correct Answer: D. Stored (persistent) Cross-Site Scripting (XSS)
Explanation: The defenses are context-aware output encoding, a Content Security Policy, and HttpOnly cookies. ALSO KNOW (related points): • What does a Content Security Policy (CSP) primarily mitigate? → XSS and data injection, by restricting where scripts and other resources can load from

Correct Answer: A. Tricking a logged-in user's browser into sending an unwanted request to a site where the user is authenticated
Explanation: The defenses are anti-CSRF tokens, SameSite cookies, and checking the Origin header.

Correct Answer: C. As salted hashes using a slow algorithm such as bcrypt, scrypt, or Argon2
Explanation: Fast hashes such as MD5 and SHA-1 are easy to brute-force, and encryption can be reversed.

Correct Answer: B. No; CORS only controls which web origins a browser lets read the responses. Server-side authentication is still required
Explanation: CORS is a browser-enforced relaxation of the same-origin policy, not an access control mechanism. ALSO KNOW (related points): • Which statement about sessions is correct? → Session data is stored on the server; the client usually keeps only a session ID in a cookie

Correct Answer: A. X-Frame-Options (or CSP frame-ancestors)
Explanation: It stops other sites from embedding your pages in an iframe.

Correct Answer: A. XSS and data injection, by restricting where scripts and other resources can load from
Explanation: For example, script-src 'self' blocks inline and third-party scripts.

Correct Answer: A. Session data is stored on the server; the client usually keeps only a session ID in a cookie
Explanation: Regenerate the session ID after login to prevent session fixation.