Most Common Application-Level Attacks CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Java web application accepts a product ID from a URL parameter and directly concatenates it into a SQL query. An attacker submits `productId=1 OR 1=1` and retrieves all product records. Which vulnerability class does this attack map to, and what is the most effective mitigation?

   • ABroken access control; implement role-based access checks
   • BCross-site scripting; encode the product ID before displaying it
   • CSQL injection; use prepared statements with parameterized queries
   • DCommand injection; validate the product ID against a whitelist
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which impact is most directly associated with a successful SQL injection attack?

   • AExecution of malicious scripts in users' browsers
   • BOverloading the server with excessive requests
   • CUnauthorized access to sensitive data stored in the database
   • DForcing users to perform unintended actions on a trusted site
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which technique is commonly used to carry out an insecure deserialization attack?

   • AUsing a cross-site scripting payload to steal session tokens from other users.
   • BCrafting a malicious serialized object that executes arbitrary code when deserialized by the application.
   • CSending a specially crafted URL that causes the server to return a different web page.
   • DFlooding the application with many requests to exhaust server resources.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Java application deserializes objects from an HTTP request without any validation. An attacker crafts a malicious serialized object that, when deserialized, executes arbitrary commands on the server. Which OWASP Top 10 vulnerability class does this attack belong to, and what is a key mitigation?

   • ACross-Site Scripting; sanitize user input
   • BSecurity Misconfiguration; disable directory listing
   • CInsecure Deserialization; implement allow-listing of classes during deserialization
   • DBroken Access Control; enforce role-based permissions
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Java web application has a search feature that reflects user input in the page without encoding. An attacker crafts a URL that, when clicked by an admin, executes JavaScript in the admin's browser session. Which attack is being executed, and which primary defense would block it?

   • ASQL injection; use prepared statements
   • BCross-site scripting (XSS); context-aware output encoding
   • CCross-site request forgery (CSRF); synchronizer token
   • DInsecure deserialization; input validation on serialized data
   Reveal Solution Discussion Select an answer first