Quiz2Know

IT

Application Security: OWASP & Modern Cryptography

Test your expertise in modern application security, OWASP Top 10 vulnerabilities, secure session management, and cryptographic implementations.

This is a free, 16-question multiple-choice quiz. Answer each question to see whether you got it right, with an explanation for every answer. There is no sign-up and no time limit — take it as many times as you like, and scroll down for the full answer key once you are done.

Question 1 of 16

0 correct

How does a Cross-Site Request Forgery (CSRF) attack exploit a user's authenticated session?

Press A–D to choose · Enter to submit

Answer key & explanations

Every question in this quiz, with the correct answer marked and an explanation of why it is right. Use it to revise before or after taking the quiz above.

  1. 1.How does a Cross-Site Request Forgery (CSRF) attack exploit a user's authenticated session?

    • AIt reads the victim's session tokens directly from their protected browser cookies
    • BIt tricks the victim's browser into sending unauthorized HTTP requests along with ambient credentials (like cookies) to a target site✓ Correct
    • CIt injects malicious JavaScript into the vulnerable site's database
    • DIt performs brute-force password guessing against the site's authentication endpoint

    Correct answer: It tricks the victim's browser into sending unauthorized HTTP requests along with ambient credentials (like cookies) to a target site

    CSRF exploits the trust a site places in a user's browser by having an untrusted site trick the user into executing unwanted actions where they are already authenticated.

  2. 2.What defense mechanism prevents JavaScript code from accessing sensitive authentication cookies in the browser?

    • ASetting the SameSite=None attribute on the cookie
    • BSetting the HttpOnly flag on the cookie✓ Correct
    • CSetting the Secure flag without HTTPS
    • DEncoding the cookie string using base64

    Correct answer: Setting the HttpOnly flag on the cookie

    The HttpOnly flag prevents client-side scripts (such as those injected via XSS) from reading document.cookie, mitigating session-hijacking attacks.

  3. 3.What is the primary technical difference between Symmetric and Asymmetric encryption?

    • ASymmetric encryption can only run on 32-bit processors; asymmetric runs on 64-bit
    • BSymmetric uses the same secret key for encryption and decryption; asymmetric uses mathematically paired public and private keys✓ Correct
    • CSymmetric encryption is only used for digital signatures; asymmetric is used for disk encryption
    • DSymmetric algorithms are completely invulnerable to quantum computing attacks

    Correct answer: Symmetric uses the same secret key for encryption and decryption; asymmetric uses mathematically paired public and private keys

    Symmetric cryptography (AES, ChaCha20) uses a shared secret key for encryption and decryption, while asymmetric cryptography (RSA, ECC) uses public/private key pairs.

  4. 4.Which password-hashing algorithm is explicitly designed to resist GPU-accelerated and ASIC-based hardware brute-force attacks?

    • AMD5
    • BSHA-256
    • CArgon2id✓ Correct
    • DHMAC-SHA1

    Correct answer: Argon2id

    Argon2id (the winner of the Password Hashing Competition) requires configurable compute time and memory allocations, resisting parallel GPU and ASIC attacks.

  5. 5.What does Cross-Origin Resource Sharing (CORS) enforce in web browsers?

    • AIt prevents web servers from hosting images on external CDNs
    • BIt allows a server to declare which external web origins are permitted to read its HTTP responses via the browser✓ Correct
    • CIt blocks all outbound network requests originating from mobile devices
    • DIt automatically encrypts outgoing form submissions using TLS 1.3

    Correct answer: It allows a server to declare which external web origins are permitted to read its HTTP responses via the browser

    CORS is a browser security mechanism that relaxes the Same-Origin Policy, allowing servers to specify via headers which external origins can access their resources.

  6. 6.What attack vector does a Server-Side Request Forgery (SSRF) vulnerability expose?

    • AIt causes the client's browser to execute unauthorized Bitcoin mining scripts
    • BIt abuses an application feature to force the vulnerable backend server to send crafted requests to internal, unexposed network resources✓ Correct
    • CIt overwrites relational database tables with garbage values
    • DIt crashes the web server by flooding its network card with SYN packets

    Correct answer: It abuses an application feature to force the vulnerable backend server to send crafted requests to internal, unexposed network resources

    SSRF allows an attacker to manipulate server functionality to make outbound requests to unintended targets, often reaching internal services (like cloud metadata APIs at 169.254.169.254).

  7. 7.Why are Parameterized Queries (Prepared Statements) effective at preventing SQL Injection?

    • AThey encrypt SQL query strings using AES-256 before transmission
    • BThey separate SQL query code from user-supplied parameters, ensuring inputs are treated strictly as literal data rather than executable code✓ Correct
    • CThey restrict database operations exclusively to read-only SELECT commands
    • DThey automatically sanitize inputs by removing all single quotes and semicolons

    Correct answer: They separate SQL query code from user-supplied parameters, ensuring inputs are treated strictly as literal data rather than executable code

    Prepared statements pre-compile the SQL template on the database server; parameter values are bound separately and treated strictly as literal data, preventing injection.

  8. 8.What is the primary security flaw in JSON Web Tokens (JWT) signed with the 'none' algorithm?

    • AThe token expires in under thirty seconds
    • BThe token contains no cryptographic signature, allowing an attacker to modify claims (like user ID or roles) without detection✓ Correct
    • CThe token payload cannot be decoded by web browsers
    • DThe token requires an active Redis database connection to validate

    Correct answer: The token contains no cryptographic signature, allowing an attacker to modify claims (like user ID or roles) without detection

    If a server improperly allows the 'none' algorithm, attackers can alter the payload (e.g., setting 'admin': true) and submit the token unsigned, bypassing authentication.

  9. 9.What is the purpose of a Content Security Policy (CSP) HTTP response header?

    • ATo define the maximum bandwidth a user can consume on a website
    • BTo instruct the browser to restrict the sources from which scripts, stylesheets, and images can be loaded and executed✓ Correct
    • CTo encrypt the webpage contents using the server's private key
    • DTo automatically convert dynamic HTML pages into static PDF documents

    Correct answer: To instruct the browser to restrict the sources from which scripts, stylesheets, and images can be loaded and executed

    A CSP restricts the domains and mechanisms from which scripts, styles, and other assets can load, mitigating Cross-Site Scripting (XSS) and data injection.

  10. 10.What vulnerability occurs when an application deserializes untrusted, user-supplied data without validation?

    • AMemory corruption leading exclusively to blue-screen hardware crashes
    • BRemote Code Execution (RCE) via arbitrary gadget chains executed during object reconstruction✓ Correct
    • CAutomatic downgrading of HTTPS connections to plain HTTP
    • DPermanent deletion of operating system firewall configurations

    Correct answer: Remote Code Execution (RCE) via arbitrary gadget chains executed during object reconstruction

    Insecure deserialization of untrusted data can trigger gadget chains—sequences of existing classes that execute arbitrary commands or code during object instantiation.

  11. 11.What is the difference between OAuth 2.0 and OpenID Connect (OIDC)?

    • AOAuth 2.0 handles authentication; OpenID Connect handles authorization
    • BOAuth 2.0 is an authorization framework (access delegation); OpenID Connect is an identity layer built on top of OAuth 2.0 for user authentication✓ Correct
    • COAuth 2.0 requires XML formats; OpenID Connect uses binary Protobuf formats
    • DOAuth 2.0 was designed strictly for mobile apps; OpenID Connect was built for desktop applications

    Correct answer: OAuth 2.0 is an authorization framework (access delegation); OpenID Connect is an identity layer built on top of OAuth 2.0 for user authentication

    OAuth 2.0 delegates resource access authorization (via Access Tokens); OpenID Connect builds on OAuth 2.0 to add verified identity and authentication (via ID Tokens).

  12. 12.What is an Insecure Direct Object Reference (IDOR)?

    • AAn unhandled NullPointerException in Java object constructors
    • BA vulnerability where an application uses user-supplied input to access database objects directly without verifying access authorization✓ Correct
    • CWriting object fields directly to the Linux file system root
    • DCalling private class methods through Java reflection APIs

    Correct answer: A vulnerability where an application uses user-supplied input to access database objects directly without verifying access authorization

    IDOR happens when an app exposes internal identifiers (like /orders/1234) without validating that the authenticated user owns or has permission to access that specific resource.

  13. 13.What protection does the 'SameSite=Strict' attribute on a session cookie provide?

    • AIt guarantees that the cookie is transmitted only over encrypted TLS channels
    • BIt instructs the browser never to send the cookie in cross-site requests, effectively neutralizing CSRF attacks from external links✓ Correct
    • CIt forces the cookie to expire whenever the user closes their browser window
    • DIt prevents the cookie from being stored on solid-state drives

    Correct answer: It instructs the browser never to send the cookie in cross-site requests, effectively neutralizing CSRF attacks from external links

    SameSite=Strict prevents the browser from sending the cookie in any cross-site browsing context (even ordinary incoming links), neutralizing cross-site request forgery.

  14. 14.In public key infrastructure (PKI), what is the purpose of Certificate Revocation Lists (CRL) and OCSP?

    • ATo verify that an IP address belongs to a verified enterprise network
    • BTo check whether an issued X.509 digital certificate has been invalidated or compromised prior to its scheduled expiration✓ Correct
    • CTo distribute private keys to client browsers over encrypted channels
    • DTo compress digital certificate file sizes before sending TLS handshakes

    Correct answer: To check whether an issued X.509 digital certificate has been invalidated or compromised prior to its scheduled expiration

    CRLs and Online Certificate Status Protocol (OCSP) allow clients to verify whether a certificate authority has revoked a certificate before its formal expiration date.

  15. 15.What is a Replay Attack in application security?

    • AFlooding a server with video streaming requests to exhaust network bandwidth
    • BIntercepting valid authentication data or network transmissions and fraudulently retransmitting them to repeat authorized actions✓ Correct
    • CCompiling software binaries twice to detect compiler vulnerabilities
    • DRewinding relational database logs to view deleted records

    Correct answer: Intercepting valid authentication data or network transmissions and fraudulently retransmitting them to repeat authorized actions

    A replay attack captures valid network transmissions (like signed requests or tokens) and re-sends them to trick the receiver into executing duplicate unauthorized operations.

  16. 16.What does Subresource Integrity (SRI) protect against in modern web frontends?

    • AUnauthorized scraping of proprietary CSS stylesheets
    • BAttacks where third-party hosted script dependencies (e.g., CDN-hosted libraries) are compromised and altered with malicious code✓ Correct
    • CCross-site scripting originating from browser extensions
    • DDenial of service attacks against static asset file servers

    Correct answer: Attacks where third-party hosted script dependencies (e.g., CDN-hosted libraries) are compromised and altered with malicious code

    SRI checks the cryptographic hash of scripts loaded from third-party CDNs; if an attacker tampers with the CDN asset, the browser hash check fails and refuses execution.

More free quizzes