10. Describe Top OWASP Threats (such as XSS, SQL Injections, and CSRF) 200-901 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security auditor is reviewing a web application and finds that the application exposes detailed error messages that reveal SQL query structure. The auditor also finds that user-supplied data is reflected in error pages without encoding. Which OWASP Top 10 categories are most directly relevant to these findings?

   • ASecurity Misconfiguration and XSS
   • BBroken Access Control and XSS
   • CInjection and XSS
   • DInjection and Security Logging Failures
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A web application uses a JavaScript framework that reads a URL parameter and directly sets innerHTML on a page element. An attacker crafts a link that causes the browser to execute a script. Which type of XSS is this, and which mitigation is most effective?

   • ADOM-based XSS; avoid using innerHTML with untrusted data and use textContent or safe DOM APIs
   • BDOM-based XSS; use a WAF to block malicious URLs
   • CReflected XSS; apply output encoding on the server
   • DStored XSS; sanitize the URL parameter before storing it
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network engineer is reviewing a web application that displays user-supplied search terms in the page without any encoding. An attacker crafts a URL with a malicious script in the search parameter, and when a victim clicks the link, the script executes in the victim's browser. Which OWASP threat is being exploited, and which mitigation would directly prevent this specific attack?

   • ASQL injection; use parameterized queries for the search function
   • BStored XSS; sanitize the search term before storing it in the database
   • CReflected XSS; apply output encoding on the search term before rendering
   • DDOM-based XSS; use a Content Security Policy to block inline scripts
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which statement accurately describes how SQL injection attacks manipulate database queries?

   • AThey inject malicious SQL code into user input fields to alter the structure or logic of the original query.
   • BThey send specially crafted HTTP headers to the web server to bypass the firewall.
   • CThey use social engineering to trick users into revealing their database credentials.
   • DThey exploit a buffer overflow in the web server to execute arbitrary commands.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A web application uses a single-page application (SPA) architecture. The SPA makes API calls to a backend that uses cookie-based authentication. The team wants to protect against CSRF. The API is accessed from multiple subdomains. Which CSRF defense is most appropriate?

   • ASet the SameSite attribute to Lax on the session cookie
   • BRely on the Origin header to validate all requests
   • CUse a synchronizer token stored in a hidden form field
   • DUse a double-submit cookie pattern with a random token in a cookie and a custom header
   Reveal Solution Discussion Select an answer first