Most Common Application-Level Attacks CASENET Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which log pattern is a strong indicator of a SQL injection attempt?

   • AA request that returns an HTTP 500 error with a stack trace.
   • BA request with an unusually long User-Agent header.
   • CA request with a 'Referer' header pointing to a known malicious site.
   • DA request containing a URL-encoded single quote followed by 'OR 1=1' in a query parameter.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A .NET application uses a third-party library that deserializes XML data. The library is known to be vulnerable to XXE attacks, but a patched version is not yet available. The application must continue processing XML from external partners. Which mitigation should the team implement to reduce the risk?

   • AValidate the XML against a schema before deserialization.
   • BEncrypt the XML payloads in transit.
   • CDisable DTD processing and external entity resolution in the XML parser settings.
   • DUse a different data format, such as JSON, for all partner communications.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A .NET web application logs all requests. An analyst sees a pattern: many requests to /api/search with a 'q' parameter containing '%00', '..\', and 'etc/passwd'. Which attack is being attempted, and what should the analyst recommend?

   • ADirectory traversal; use canonicalization and reject paths that contain traversal sequences.
   • BSQL injection; use parameterized queries.
   • CCommand injection; use ProcessStartInfo with argument lists.
   • DLDAP injection; use input validation.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the typical execution flow of a stored XSS attack?

   • AAttacker exploits a server-side vulnerability to execute arbitrary code on the server, which then serves malicious content to all users.
   • BAttacker sends a crafted link to the victim; the victim clicks it, and the script executes immediately in the victim's browser.
   • CAttacker intercepts the victim's request and modifies it to include a malicious script before it reaches the server.
   • DAttacker submits malicious script to the server; the server stores it; later, a victim retrieves the page and the script executes in the victim's browser.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   Users of a .NET web application report that after clicking a link in an email, their browser shows a page with a form that submits to the application's change-password endpoint. The application uses session cookies but does not include any anti-CSRF token. Which attack is most likely being attempted, and what is the most effective mitigation?

   • ACross-site scripting (XSS); enable output encoding on all form fields.
   • BCross-site request forgery (CSRF); implement anti-CSRF tokens on all state-changing requests.
   • CSQL injection; use parameterized queries for the password update.
   • DSession fixation; regenerate the session ID after login.
   Reveal Solution Discussion Select an answer first