Common Threats on User Authentication and Authorization CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A web application allows users to log in and then navigate to different pages. After login, the application sets a session cookie but does not set the Secure or HttpOnly flags. An attacker exploits a stored XSS vulnerability to steal the cookie. Which threat has occurred, and which mitigation would have prevented it?

   • ACredential stuffing; implement account lockout
   • BBrute force; enforce strong password policy
   • CSession hijacking; set the Secure and HttpOnly flags on the session cookie
   • DPrivilege escalation; implement role-based access control
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which authentication threat occurs when an attacker intercepts a valid session token and uses it to impersonate the legitimate user?

   • ASession hijacking
   • BPassword spraying
   • CBrute force attack
   • DCredential stuffing
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security analyst is assessing the impact of a credential stuffing attack on a web application. The application has multi-factor authentication (MFA) enabled for all users. What is the most likely impact of the attack?

   • AThe attacker can still log in if they have the correct password.
   • BThe attack is largely mitigated because the attacker lacks the second factor.
   • CThe attacker can bypass MFA by using a stolen session cookie.
   • DThe attack will cause a denial of service due to failed login attempts.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the most significant potential impact of a successful privilege escalation attack on a web application?

   • AThe application's source code is exposed to the public
   • BUsers are tricked into revealing their passwords
   • CThe application becomes temporarily unavailable due to resource exhaustion
   • DAn attacker gains unauthorized access to sensitive data and performs administrative actions
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's web application allows users to log in with their email and password. The security team is concerned about credential stuffing attacks. Which additional control would be most effective in preventing attackers from using stolen credentials?

   • AAdd a CAPTCHA to the login form.
   • BUse a longer password minimum length.
   • CDisable the login form after a certain number of failed attempts.
   • DImplement multi-factor authentication (MFA) for all users.
   Reveal Solution Discussion Select an answer first