Objective 1.4 Exploit Web-Application Vulnerabilities. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which technique involves converting special characters into a percent-encoded format to obfuscate payloads or bypass input filters?

   • AHex Encoding
   • BURL Encoding
   • CBase64 Encoding
   • DHTML Encoding
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A web service accepts XML data and processes it. A tester wants to read a local file and also make the server send a request to an internal service. Which XXE payload would achieve both objectives?

   • ADefine an external entity that references an internal URL and use it in the response
   • BUse a parameter entity to read the file and then use it in a URL
   • CDefine an external entity that references a local file and use it in the response
   • DDefine two external entities, one for the local file and one for the internal URL, and use both in the response
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which vulnerability occurs when an XML parser processes external entities defined in a Document Type Definition (DTD), allowing an attacker to read local files or perform SSRF?

   • APath Traversal
   • BCross-Site Scripting (XSS)
   • CSQL Injection
   • DXML External Entity (XXE) Injection
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   While intercepting HTTP traffic with a proxy, a tester notices a hidden form field containing a price value. Which type of information is being disclosed?

   • AServer-side configuration
   • BEncryption keys
   • CDatabase credentials
   • DSensitive data in client-side parameters
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A penetration tester injects a JavaScript payload into a search field. When a user submits the search, the script executes in their browser without being stored on the server. Which type of XSS vulnerability is this?

   • AStored XSS
   • BBlind XSS
   • CReflected XSS
   • DDOM-based XSS
   Reveal Solution Discussion Select an answer first