Web Application Penetration Testing CPENT Practice Questions (Page 13)

Questions 61–63

1. 61foundation · easy

   Which security header, when missing, can leave a web application vulnerable to clickjacking attacks?

   • AStrict-Transport-Security
   • BX-Frame-Options
   • CX-Content-Type-Options
   • DContent-Security-Policy
   Reveal Solution Discussion Select an answer first
2. 62foundation · easy

   Which of the following is a common target of SSRF attacks?

   • AThe client's local file system
   • BInternal metadata services like AWS EC2 metadata (169.254.169.254)
   • CThe user's session cookie
   • DThe user's browser cache
   Reveal Solution Discussion Select an answer first
3. 63foundation · easy

   What is the primary risk of using weak ciphers in TLS?

   • AThe client's browser may crash
   • BData transmitted between client and server can be decrypted by an attacker
   • CThe server's IP address can be spoofed
   • DThe server becomes slower due to encryption overhead
   Reveal Solution Discussion Select an answer first