Web Application Penetration Testing CPENT Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary difference between Server-Side Request Forgery (SSRF) and Cross-Site Request Forgery (CSRF)?

   • ASSRF tricks the server into making requests, while CSRF tricks the user's browser into making requests
   • BSSRF uses JavaScript, while CSRF uses HTTP requests
   • CSSRF is a client-side attack, while CSRF is a server-side attack
   • DSSRF is used to steal cookies, while CSRF is used to execute code
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A penetration tester discovers that a normal user can access another user's profile by changing the 'user_id' parameter in the URL. Which type of access control vulnerability is this?

   • ACross-site scripting
   • BSession fixation
   • CHorizontal privilege escalation
   • DVertical privilege escalation
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a recommended practice to prevent session fixation attacks?

   • AStore the session ID in a cookie without the Secure flag
   • BUse a longer session timeout
   • CRegenerate the session ID after successful authentication
   • DAccept session IDs from both cookies and URL parameters
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a gap in logging and monitoring that can allow an attacker to evade detection?

   • AUsing centralized log management
   • BNot logging failed login attempts
   • CSetting log retention policies
   • DLogging successful logins
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which threat modeling framework uses a structured approach to categorize threats into Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

   • AOWASP Top 10
   • BPASTA
   • CDREAD
   • DSTRIDE
   Reveal Solution Discussion Select an answer first