10. Describe Top OWASP Threats (such as XSS, SQL Injections, and CSRF) 200-901 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security engineer is reviewing a web application that has both XSS and CSRF vulnerabilities. The application uses cookies for authentication. The team wants to implement a single control that reduces the risk of both attacks. Which control is most effective for both?

   • AAdd CSRF tokens to all state-changing forms
   • BUse the SameSite=Strict attribute on the session cookie
   • CUse HttpOnly cookies to protect session tokens
   • DImplement a Content Security Policy that disallows inline scripts
   Reveal Solution Discussion Select an answer first
2. 17application · medium · select all that apply

   A development team is conducting a security review of a web application. They have identified the following issues: (1) user input is concatenated into SQL queries, (2) state-changing forms lack anti-CSRF tokens, and (3) user-supplied data is rendered without encoding. Which of the following are appropriate mitigations? Select all that apply.

   • ADisable JavaScript in the browser
   • BApply context-aware output encoding when rendering user data
   • CAdd a unique CSRF token to each form and validate it on the server
   • DUse parameterized queries for all database access
   • ESet the Secure flag on all cookies
   Check answers Discussion Select an answer first
4. 18application · medium

   A user is logged into a banking website. In another browser tab, the user visits a malicious site that contains an image tag pointing to the banking site's transfer endpoint with parameters to move funds. The browser automatically sends the banking site's cookies with the request, and the transfer is executed. Which OWASP threat is this, and what is the most effective mitigation?

   • ACSRF; implement a synchronizer token that must accompany state-changing requests
   • BXSS; enable HttpOnly cookies to prevent script access
   • CSQL injection; use input validation on the transfer amount
   • DCSRF; rely on the SameSite cookie attribute alone to block all cross-site requests
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A user is logged into a banking website. While browsing another site, the user clicks a link that triggers a request to the banking site to transfer funds to the attacker's account. The banking site does not verify the origin of the request. Which type of attack is this?

   • ASQL Injection
   • BCross-Site Request Forgery (CSRF)
   • CCross-Site Scripting (XSS)
   • DSession Hijacking
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A development team is hardening a web application that accepts user comments and later displays them, and also queries a database using the comment text. Which combination of controls provides the most comprehensive defense against both stored XSS and SQL injection?

   • AOutput-encode comments when rendering and use parameterized queries when storing or retrieving them
   • BStore comments as base64-encoded blobs and decode them on display
   • CDisable JavaScript in the browser and restrict database user permissions
   • DUse a Web Application Firewall (WAF) and require HTTPS for all traffic
   Reveal Solution Discussion Select an answer first