Testing Identification, Authentication and Authorization CT-STE Practice Questions (Page 5)

Questions 21–24

1. 21expert · medium

   A security tester is evaluating a web application that uses a session cookie for authentication. The tester notices that the session cookie is set with the 'Secure' flag but not the 'HttpOnly' flag. The tester also discovers a stored XSS vulnerability in the application. Which of the following is the MOST significant additional risk introduced by the missing 'HttpOnly' flag?

   • AAn attacker can modify the session cookie to escalate privileges.
   • BAn attacker can perform a cross-site request forgery (CSRF) attack.
   • CAn attacker can steal the session cookie via JavaScript and impersonate the user.
   • DAn attacker can perform a man-in-the-middle attack to intercept the cookie.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security tester is assessing a web application that allows users to register with an email address. The application sends a verification email with a link that contains a token. The tester notices that the token is a sequential number (e.g., 12345, 12346). Which of the following is the MOST significant risk associated with this design?

   • AAn attacker can perform a cross-site scripting (XSS) attack.
   • BAn attacker can guess the token and verify an email address they do not own.
   • CAn attacker can perform a man-in-the-middle attack to intercept the token.
   • DAn attacker can perform a denial-of-service attack by sending many verification requests.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A tester is reviewing a microservices architecture where each service uses its own JWT for authorization. The tester discovers that the JWT signing key is shared across all services. An attacker compromises one service and extracts the signing key. Which of the following is the MOST significant security impact?

   • AThe attacker can perform a denial-of-service attack on the services.
   • BThe attacker can only forge JWTs for the compromised service.
   • CThe attacker can decrypt all traffic between services.
   • DThe attacker can forge JWTs for any service in the architecture.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A tester is evaluating a mobile banking application that uses biometric authentication (fingerprint) to authorize transactions. The tester discovers that the application stores a cryptographic key in the device's secure enclave, and the fingerprint is used to unlock the key. However, the tester also finds that the application has a 'fallback' mechanism that allows the user to enter a 4-digit PIN if the fingerprint fails. The tester attempts to brute-force the PIN by trying all 10,000 combinations. The application does not have any rate limiting or lockout mechanism. Which of the following is the MOST significant security weakness in this design?

   • AThe cryptographic key is stored in the secure enclave, which is not accessible to the application.
   • BThe fallback mechanism bypasses the biometric authentication, which is the primary security control.
   • CThe use of a 4-digit PIN is inherently insecure because it has only 10,000 possible combinations.
   • DThe application does not implement a lockout or rate-limiting mechanism for the PIN fallback.
   Reveal Solution Discussion Select an answer first