OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
1. Spoofing
2. Cross-site request forgery
3. Denial of service Correct
4. Insecure direct object references
2) Your application is created using a language that does not support a clear distinction
between code and data. Which vulnerability is most likely to occur in your application?
1. Injection Correct
2. Insecure direct object references
3. Failure to restrict URL access
4. Insufficient transport layer protection
4) A user is able to pass malicious input that invokes control codes in your Web
application. Which vulnerability is most likely to occur in your Web application?
1. Injection Correct
2. Insecure direct object references
3. Failure to restrict URL access
4. Insufficient transport layer protection
5) Which of the following is the best way to protect against injection attacks?
1. Session IDs
2. Registry keys
3. Regular expressions Correct
4. Server configuration files
8) Which mitigation technique can help you strictly define valid input?
1. Allow list
2. Table indirection Correct
3. Escaping
4. Memory size checks
10) Which mitigation technique helps you tell the parser that a specific character is a
literal and not a control character?
1. Table indirection
2. Allow list
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 2/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
3. Escaping Correct
4. Block list
11) State whether the following statement is True or False. You should use a blacklist
wherever possible; use whitelists only as a secondary defense.
1. True
2. False Correct
12) Which of the following is the best way to define disallowed inputs?
1. Allow list
2. Block list Correct
3. Table indirection
4. Escaping
14) Which of the following languages are the primary targets of cross-site scripting?
1. HTML Correct
2. SQL
3. XSLT
4. XPath
15) Which of the following attacks occurs when a malicious user convinces a victim to
send a request to a server with malicious input and the server echoes the input back to
client?
16) Which of the following is the best way to prevent a DOM-based XSS attack?
18) Which of the following is the best way to prevent malicious input exploiting your
application?
19) You should set the HttpOnly flag in a cookie to ensure that:
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 4/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
21) An attacker submits data to the server and the data is stored on the server. Which
type of vulnerability is most likely to occur in your application?
1. DOM-based XSS
2. Reflected XSS
3. Persistent XSS Correct
4. Cross-site request forgery
22) Which of the following input sources can be directly controlled by a malicious
user?
23) Which of the following scenarios is most likely to result in broken authentication
and session management vulnerabilities?
24) Which of the following actions should you take before implementing a custom
authentication and session management system?
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 5/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
25) State whether the following statement is True or False. When implementing an
authentication or session system, you should ensure that new session IDs are not
created at login.
1. True
2. False Correct
26) Which of the following functionalities should you include in an authentication and
session management system?
28) What should you do before passing credentials over the network?
29) Which location should you ideally use to store a session ID?
1. URLs
2. Form variables
3. Persistent cookies
4. Non-persistent cookies Correct
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 6/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
30) Which of the following is the best way to ensure that JavaScript cannot be used to
access a cookie?
33) State whether the following statement is True or False. An identification token is a
replacement for a user’s credentials and should allow access to restricted resources of a
Web site.
1. True
2. False Correct
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 7/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
35) Which threat is most likely to occur when a Web application fails to validate a
client's access to a resource?
1. Injection
2. Cross-site scripting
3. Insecure direct object reference Correct
4. Cross-site request forgery
36) Which of the following objects is most susceptible to an insecure direct object
reference attack?
1. Nonpersistent cookies
2. Registry keys Correct
3. Conditional constructs
4. GET/POST parameters
37) Which of the following vulnerabilities is most likely to occur due to an insecure
direct object reference attack?
38) Which of the following is the best way to mitigate the threat of an insecure direct
object reference attack?
39) State whether the following statement is True or False. Time of Check Time of Use
(TOCTOU) occurs if the authorization check is performed on one page of a Web site
and the resource is used on a different page.
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 8/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
1. True Correct
2. False
40) Your Web application stores information about many accounts. Which threat is
your Web application susceptible to if you can manipulate the URL of an account page
to access all accounts?
41) Which of the following threats is most likely to be caused by poor input validation?
1. Enabling of IPSec
2. Insecure direct object reference Correct
3. Insecure cryptographic storage
4. Insufficient transport layer protection
42) Which threat is most likely to occur when a POST parameter performs an operation
on behalf of a user without checking a shared secret?
43) Which of the following is the most common result of a cross-site request forgery?
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 9/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
1. Injection
2. Cross-site scripting
3. Insecure direct object reference
4. Cross-site request forgery Correct
45) State whether the following statement is True or False. The downside of a nonce is
that it needs to be stored on the client.
1. True
2. False Correct
46) What should you add to an HMAC to ensure that the secret value is unique for each
request?
1. Salt
2. Nonce
3. Session ID
4. Timestamp Correct
47) Which of the following practices should you observe in order to implement
defense-in-depth techniques against CSRF attacks?
48) State whether the following statement is True or False. HTTP GET parameters
limit the types of manipulation a malicious user can perform on the victim to forge a
request.
1. True
2. False Correct
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 10/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
49) Which of the following mistakes is most often associated with a security
misconfiguration threat?
50) You have not yet applied some recent service packs and updates to your Web
application. Which of the following threats is your Web server susceptible to?
1. Injection
2. Security misconfiguration Correct
3. Insecure cryptographic storage
4. Cross-site request forgery
51) Which of the following is the best way to reevaluate your environment and address
new threats?
52) Which of the following procedures are involved in the hardening process?
53) Which of the following consequence is most likely to result if your production
environment does not match your development, testing, and staging environments?
1. Unused services
2. Unsalted hash Correct
3. New products
4. Missing patches
1. HTTP
2. EFS
3. IPSec Correct
4. Kerberos
1. Complexity Correct
2. Session-based indirection
3. Escaping
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 12/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
4. Encryption
1. Nonce
2. Digital signature Correct
3. SSL
4. Salt
60) hich of the following depicts the typical impact of failure to restrict URL access?
61) Which of the following actions should you take to test the security of your Web
application?
62) Which of the following should you use to protect the connections between the
physical tiers of your application?
1. EFS
2. SSL Correct
3. HTTP
4. Kerberos
63) Which of the following is the best way to implement transport layer protection?
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 13/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
1. Install IDS
2. Enable SSL Correct
3. Set the HttpOnly flag on session ID cookies
4. Perform client-side validation.
64) Which of the following is most likely to result from unvalidated redirects and
forwards?
65) Which of the following is the best way to protect a Web application from
unvalidated redirects and forwards?
66) Which of the following is the best way to detect unvalidated redirects and
forwards?
1. Use internal transfers without authorizing the user for target URL
2. Use your browser to forge unauthorized requests
3. Use weblogs to identify redirects and forwards Correct
4. Use policy mechanisms
67) State whether the following statement is True or False. Most security issues are
related to input and a user’s ability to interact with and control input.
1. True Correct
2. False
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 14/15
21/11/2019 OWASP Top 10 Threats and Mitigations Exam - Single Select - OWASP
68) State whether the following statement is True or False. If user input can be
confused for instructions in the language or the way the language is applied, then the
language is vulnerable to an injection attack.
1. True Correct
2. False
69) In which of the following scenarios should you use the escaping technique?
70) Which of the following is the best way to prevent unvalidated redirect and forwards
vulnerabilities?
https://www.owasp.org/index.php/OWASP_Top_10_Threats_and_Mitigations_Exam_-_Single_Select 15/15