Web Application Fundamentals SCE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A developer is building a form that lets users submit comments on a blog. The comments are displayed to other users. To prevent stored XSS attacks, which approach should be taken when rendering the comments in the browser?

   • ARemove all <script> tags from the input on the server side before storing it.
   • BUse JavaScript's innerHTML property to insert the comment text directly into the page.
   • CStore the comments in the database as raw HTML and rely on the browser's built-in XSS filter.
   • DEscape all user-supplied content before inserting it into the HTML DOM.
   Reveal Solution Discussion Select an answer first
2. 47application · easy

   A web application has a front-end built with HTML, CSS, and JavaScript, and a back-end that uses a server-side framework to query a database and return JSON. The front-end makes AJAX requests to the back-end API. Which layer is responsible for rendering the user interface?

   • AThe middleware layer
   • BThe client-side HTML, CSS, and JavaScript
   • CThe database layer
   • DThe server-side framework
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   In a typical three-tier web application architecture, which component is responsible for storing and retrieving persistent data?

   • AClient layer
   • BDatabase layer
   • CMiddleware layer
   • DServer layer
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A company exposes a REST API that returns sensitive customer data. The API uses API keys in the query string for authentication. A security review flags this as a risk. Which change is the most secure and practical improvement?

   • AUse a session cookie instead of an API key.
   • BSwitch to Basic Authentication with the API key as the password.
   • CKeep the API key in the query string but use HTTPS to encrypt it.
   • DMove the API key from the query string to a custom HTTP header (e.g., X-API-Key) and enforce HTTPS.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A user reports that after logging into a banking site, they are redirected to a page that looks identical to the login page but on a different domain (bank.example.com vs bank-example.com). They enter their credentials again and later find unauthorized transactions. What type of attack occurred and what is the most effective defense?

   • AMan-in-the-middle attack — use a VPN.
   • BSession hijacking — use Secure cookies and HTTPS.
   • CPhishing via a lookalike domain — use HSTS and educate users to verify the domain.
   • DCross-site scripting (XSS) — implement output encoding.
   Reveal Solution Discussion Select an answer first