Kostenlos · ohne Anmeldung · ohne Zeitlimit
Fertige Multiple-Choice-Übungsquizze, von Hand geprüft. Löse jedes Gratis-Quiz online — jede Antwort kommt mit Erklärung, und jede Quiz-Seite hat einen vollständigen Lösungsschlüssel zum Wiederholen.
IT
Test your expertise in modern application security, OWASP Top 10 vulnerabilities, secure session management, and cryptographic implementations. Beantworte jede Frage und sieh sofort, ob du richtig liegst — jedes Mal mit Erklärung.
Ein kostenloser Multiple-Choice-Übungstest mit 16 Fragen zu IT. Jede Frage hat eine richtige Antwort und eine kurze Erklärung, und der vollständige Lösungsschlüssel unter dem Quiz dient zugleich als Lernzettel. Kein Konto, kein Zeitlimit — löse ihn so oft du willst.
Dies ist ein kostenloses Multiple-Choice-Quiz mit 16 Fragen. Nach jeder Antwort siehst du, ob sie richtig war — immer mit Erklärung. Keine Anmeldung, kein Zeitlimit: Mach es so oft du willst und nutze den Lösungsschlüssel oben zum Wiederholen, vorher oder nachher.
Richtige Antwort: BIt tricks the victim's browser into sending unauthorized HTTP requests along with ambient credentials (like cookies) to a target site
CSRF exploits the trust a site places in a user's browser by having an untrusted site trick the user into executing unwanted actions where they are already authenticated.
Richtige Antwort: BSetting the HttpOnly flag on the cookie
The HttpOnly flag prevents client-side scripts (such as those injected via XSS) from reading document.cookie, mitigating session-hijacking attacks.
Richtige Antwort: BSymmetric uses the same secret key for encryption and decryption; asymmetric uses mathematically paired public and private keys
Symmetric cryptography (AES, ChaCha20) uses a shared secret key for encryption and decryption, while asymmetric cryptography (RSA, ECC) uses public/private key pairs.
Richtige Antwort: CArgon2id
Argon2id (the winner of the Password Hashing Competition) requires configurable compute time and memory allocations, resisting parallel GPU and ASIC attacks.
Richtige Antwort: BIt allows a server to declare which external web origins are permitted to read its HTTP responses via the browser
CORS is a browser security mechanism that relaxes the Same-Origin Policy, allowing servers to specify via headers which external origins can access their resources.
Richtige Antwort: BIt abuses an application feature to force the vulnerable backend server to send crafted requests to internal, unexposed network resources
SSRF allows an attacker to manipulate server functionality to make outbound requests to unintended targets, often reaching internal services (like cloud metadata APIs at 169.254.169.254).
Richtige Antwort: BThey separate SQL query code from user-supplied parameters, ensuring inputs are treated strictly as literal data rather than executable code
Prepared statements pre-compile the SQL template on the database server; parameter values are bound separately and treated strictly as literal data, preventing injection.
Richtige Antwort: BThe token contains no cryptographic signature, allowing an attacker to modify claims (like user ID or roles) without detection
If a server improperly allows the 'none' algorithm, attackers can alter the payload (e.g., setting 'admin': true) and submit the token unsigned, bypassing authentication.
Richtige Antwort: BTo instruct the browser to restrict the sources from which scripts, stylesheets, and images can be loaded and executed
A CSP restricts the domains and mechanisms from which scripts, styles, and other assets can load, mitigating Cross-Site Scripting (XSS) and data injection.
Richtige Antwort: BRemote Code Execution (RCE) via arbitrary gadget chains executed during object reconstruction
Insecure deserialization of untrusted data can trigger gadget chains—sequences of existing classes that execute arbitrary commands or code during object instantiation.
Richtige Antwort: BOAuth 2.0 is an authorization framework (access delegation); OpenID Connect is an identity layer built on top of OAuth 2.0 for user authentication
OAuth 2.0 delegates resource access authorization (via Access Tokens); OpenID Connect builds on OAuth 2.0 to add verified identity and authentication (via ID Tokens).
Richtige Antwort: BA vulnerability where an application uses user-supplied input to access database objects directly without verifying access authorization
IDOR happens when an app exposes internal identifiers (like /orders/1234) without validating that the authenticated user owns or has permission to access that specific resource.
Richtige Antwort: BIt instructs the browser never to send the cookie in cross-site requests, effectively neutralizing CSRF attacks from external links
SameSite=Strict prevents the browser from sending the cookie in any cross-site browsing context (even ordinary incoming links), neutralizing cross-site request forgery.
Richtige Antwort: BTo check whether an issued X.509 digital certificate has been invalidated or compromised prior to its scheduled expiration
CRLs and Online Certificate Status Protocol (OCSP) allow clients to verify whether a certificate authority has revoked a certificate before its formal expiration date.
Richtige Antwort: BIntercepting valid authentication data or network transmissions and fraudulently retransmitting them to repeat authorized actions
A replay attack captures valid network transmissions (like signed requests or tokens) and re-sends them to trick the receiver into executing duplicate unauthorized operations.
Richtige Antwort: BAttacks where third-party hosted script dependencies (e.g., CDN-hosted libraries) are compromised and altered with malicious code
SRI checks the cryptographic hash of scripts loaded from third-party CDNs; if an attacker tampers with the CDN asset, the browser hash check fails and refuses execution.