Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 9)

Questions 41–42

1. 41application · medium

   A Java web application exposes a REST API that allows users to update their profile information. The API also includes an administrative endpoint that is not documented but is accessible without authentication. During an attack surface analysis, which entry point should be considered the highest risk?

   • AThe user authentication mechanism
   • BThe user profile update endpoint
   • CThe undocumented administrative endpoint
   • DThe API documentation
   Reveal Solution Discussion Select an answer first
2. 42expert · medium

   A Java application has a vulnerability that allows an attacker to perform a CSRF attack to change a user's email address. The application uses a session cookie for authentication. Which control would be most effective in mitigating this vulnerability?

   • ASetting the HttpOnly flag on the session cookie
   • BImplementing input validation
   • CAdding a CSRF token to forms
   • DUsing HTTPS for all communications
   Reveal Solution Discussion Select an answer first