Objective 1.01 Explain the Potential Effects of Common Attacks on Web Applications 303 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A healthcare organization's patient portal was compromised. An attacker exploited a vulnerability in a third-party component to upload a webshell and gain persistent access to the server. The organization must now report the breach to regulators. Which OWASP Top Ten category does this vulnerability belong to, and what is the primary business impact?

   • ASecurity Logging and Monitoring Failures; reputational damage only
   • BBroken Access Control; financial loss from ransom
   • CInjection; service disruption and downtime
   • DVulnerable and Outdated Components; data breach and regulatory reporting obligations
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is investigating an incident where an attacker used a cross-site scripting (XSS) payload to steal session cookies from authenticated users. The stolen cookies were then used to access user accounts and change email addresses. Which combination of OWASP Top Ten risks and impacts does this incident represent?

   • AInsecure Design leading to Injection, resulting in service disruption
   • BInjection (XSS) leading to Broken Access Control, resulting in account takeover and data modification
   • CSecurity Misconfiguration leading to Cryptographic Failures, resulting in data breach
   • DBroken Authentication leading to Injection, resulting in reputational damage
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is deploying ASM to protect a web application that processes credit card payments. The security team must ensure compliance with PCI DSS, which requires protecting cardholder data. The application has a known vulnerability that could allow an attacker to extract card numbers via a response-based attack. Which ASM feature is MOST critical to deploy to mitigate this specific risk?

   • AIP intelligence to block known malicious sources
   • BData Guard to detect and mask credit card numbers in responses
   • CDoS protection to prevent overwhelming the payment system
   • DBot Defense to block automated scraping of card data
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large enterprise runs a critical web application that handles both authenticated user sessions and public content. The security team must choose between two ASM policies: Policy A has strict signature enforcement and blocks all suspicious requests; Policy B has signature enforcement in 'Alarm' mode and relies on bot defense and rate limiting. The application has a history of false positives that caused customer-facing outages. Which policy is MORE appropriate, and why?

   • APolicy A, because blocking all suspicious requests is the only way to ensure security
   • BPolicy B, because signature enforcement is not necessary when bot defense is enabled
   • CPolicy B, because it balances security with availability by alerting on suspicious signatures while using bot defense to handle automated threats
   • DPolicy A, because bot defense is not effective against application-layer attacks
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which BIG-IP ASM policy element is used to enforce a positive security model by defining expected input patterns for a specific parameter, thereby mitigating injection attacks?

   • ACookie attributes
   • BURL access rules
   • CSession tracking settings
   • DParameter validation rules
   Reveal Solution Discussion Select an answer first