Common Threats on User Authentication and Authorization CASENET Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security analyst is assessing the impact of a session hijacking vulnerability in a web application. The application uses session cookies without the Secure flag, and the site is accessible over both HTTP and HTTPS. An attacker on the same network uses a tool to intercept HTTP traffic and steals a session cookie. What is the most significant impact of this vulnerability?

   • AThe attacker can only view the victim's personal information.
   • BThe attacker can escalate privileges to an administrator.
   • CThe attacker can change the victim's password.
   • DThe attacker can impersonate the victim and perform any action the victim is authorized to do.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A banking application allows users to transfer funds. The application uses a session cookie that is not marked HttpOnly, and the site has a stored XSS vulnerability in the user profile field. An attacker crafts a malicious script that, when executed in a victim's browser, sends the session cookie to the attacker's server. What is the most likely impact of this attack?

   • AThe attacker can escalate privileges to an administrator account.
   • BThe attacker can only view the victim's profile information.
   • CThe attacker can hijack the victim's session and perform unauthorized fund transfers.
   • DThe attacker can change the victim's password.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   An attacker collects username and password pairs from a previous data breach and tries them against a web application's login page. Which authentication threat does this describe?

   • ABrute force attack
   • BCredential stuffing
   • CPhishing
   • DSession hijacking
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A web application uses cookie-based sessions. The security team wants to mitigate the risk of session hijacking via network eavesdropping. Which configuration should be applied to the session cookie?

   • ASet the cookie domain to the application's domain only.
   • BSet the HttpOnly flag on the session cookie.
   • CSet the Secure flag on the session cookie.
   • DSet the SameSite attribute to Strict.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A project management tool has a feature where users can view their own tasks by navigating to /tasks/{taskId}. A security review finds that any authenticated user can access tasks belonging to other users by simply changing the taskId in the URL. The application uses role-based access control, and the 'User' role is supposed to only access their own tasks. What is the most appropriate fix?

   • AEncrypt the task ID in the URL.
   • BAdd an authorization check in the controller that verifies the task belongs to the logged-in user.
   • CImplement role-based authorization on the controller action.
   • DUse a random GUID instead of sequential integers for task IDs.
   Reveal Solution Discussion Select an answer first