Most Common Application-Level Attacks CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A .NET application has an endpoint that accepts XML data and processes it using XmlDocument with DTD processing enabled. An attacker sends a crafted XML payload that causes the application to read a local file and include it in the response. Which attack is this, and what is the best mitigation?

   • AXML External Entity (XXE) injection; disable DTD processing and use XmlReader with DtdProcessing.Prohibit.
   • BSQL injection; use parameterized queries for XML data.
   • CCross-site scripting; encode the XML response.
   • DInsecure deserialization; use a safe serializer.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is the primary characteristic of an injection attack against a web application?

   • AAn attacker replaces a serialized object with a modified one to alter application logic.
   • BAn attacker sends untrusted data to an interpreter that executes it as part of a command or query.
   • CAn attacker embeds malicious script in a page that executes in another user's browser session.
   • DAn attacker tricks a user's browser into making an unintended request to a site where the user is authenticated.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the most likely impact of a successful SQL injection attack on a web application?

   • AUnauthorized access to, modification of, or deletion of data in the underlying database.
   • BThe attacker can replace serialized objects to alter application logic.
   • CThe attacker gains the ability to execute arbitrary JavaScript in the victim's browser.
   • DThe attacker can force the victim's browser to send forged requests to other sites.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst is reviewing logs from a .NET application. The logs show a series of requests to /api/account/update with a 'role' parameter that changes from 'user' to 'admin' in the URL, and the responses include the updated role. The application uses cookie authentication. Which attack is most likely, and what is the best immediate mitigation?

   • AParameter tampering; move authorization decisions to the server and validate the role against the authenticated user's identity.
   • BInsecure deserialization; use a safe serializer for the role.
   • CCSRF; add anti-forgery tokens to the update endpoint.
   • DSession fixation; regenerate session IDs after login.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A .NET application uses a binary serialization library that is known to be vulnerable to insecure deserialization. The application must continue using the library for legacy compatibility, but the team can modify the code around the deserialization calls. Which mitigation should they implement?

   • AValidate the serialized data with a checksum.
   • BImplement a custom serialization binder that restricts types to an allowlist.
   • CEncrypt the serialized data before storing it.
   • DUse a different serialization format, such as JSON, for new data.
   Reveal Solution Discussion Select an answer first