Most Common Application-Level Attacks CASENET Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A .NET application deserializes objects from a binary format stored in a cookie to maintain user preferences. A penetration test found that modifying the cookie can cause arbitrary code execution. Which mitigation is most appropriate?

   • AUse a custom binder that only allows a specific type.
   • BSign the cookie with HMAC to prevent modification.
   • CReplace binary deserialization with JSON serialization and validate the data model.
   • DEncrypt the cookie with a strong symmetric algorithm.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A .NET application uses cookies to store a user's role (e.g., 'role=admin'). A security assessment finds that users can change the cookie value to escalate privileges. Which combination of controls should be implemented?

   • AEncrypt the cookie value with a symmetric key.
   • BUse ViewState to store the role with MAC validation.
   • CStore the role in a server-side session and use HttpOnly, Secure cookies for the session ID.
   • DSign the cookie with HMAC and validate on each request.
   Reveal Solution Discussion Select an answer first
3. 28foundation · easy

   Which mitigation is most effective in preventing SQL injection vulnerabilities?

   • AImplementing CAPTCHA on all forms.
   • BUsing a web application firewall (WAF) as the sole defense.
   • CUsing parameterized queries or prepared statements for all database access.
   • DEncoding all user input with HTML entities before storing it in the database.
   Reveal Solution Discussion Select an answer first