Introduction to Web Security Answers 1. What is the primary function of a Web Application Firewall (WAF)? A. To manage user passwords securely B. To filter and monitor HTTP traffic for malicious code C. To monitor user behavior within applications D. To encrypt communication between users and websites Answer: To filter and monitor HTTP traffic for malicious code (B) WAFs are designed specifically to filter and monitor HTTP traffic to protect web applications from various attacks. 2. Which of the following best describes the Secure Development Lifecycle (SDL)? A. A process that evaluates user behavior in real-time B. A framework for managing user credentials safely C. An approach that integrates security at every stage of software development D. A method of encrypting sensitive data during transmission Answer: An approach that integrates security at every stage of software development (C) SDL emphasizes the integration of security considerations at all phases of software development to prevent vulnerabilities. 3. Which of these practices helps ensure that sensitive data is protected during transmission? A. Utilizing HTTPS for data transmission B. Disabling all encryption methods C. Using unsecured protocols for communication D. Encoding data to prevent unauthorized access Answer: Utilizing HTTPS for data transmission (A) HTTPS is a secure version of HTTP that uses encryption to protect data transmitted between a web server and a browser. 4. What role does incident response planning play in security management? A. It establishes a method for handling security breaches effectively B. It encrypts communication between different applications C. It regularly audits software for vulnerabilities D. It provides training to users about security protocols Answer: It establishes a method for handling security breaches effectively (A) An incident response plan is crucial for outlining procedures to follow during security breaches to minimize damage. 5. How does two-factor authentication enhance security? A. By requiring only a username and password B. By using cookies to remember user sessions C. By encrypting passwords before transmission D. By adding a second form of verification to user identification Answer: By adding a second form of verification to user identification (D) Two-factor authentication provides an additional layer of security by requiring users to verify their identity in more than one way. 6. What is the purpose of input validation in web security? A. To encrypt database connections. B. To create backup copies of user data. C. To generate user authentication tokens. D. To check and sanitize user inputs to prevent malicious code execution. Answer: To check and sanitize user inputs to prevent malicious code execution. (D) Input validation is crucial in preventing attacks like XSS and SQL injection. 7. Which of the following describes Cross-Site Request Forgery (CSRF)? A. A form of attack where attackers inject malicious scripts into web pages. B. An attack that compromises user sessions by hijacking authentication tokens. C. An attempt to overload a server with traffic to render it unavailable. D. A situation where attackers trick users into performing unwanted actions on a trusted website. Answer: A situation where attackers trick users into performing unwanted actions on a trusted website. (D) CSRF involves tricking users into executing unwanted actions on a trusted site. 8. Which measure helps to mitigate the risk of SQL Injection attacks? A. Input validation on user inputs used in database queries. B. Relying solely on user-generated content. C. Implementing CAPTCHA challenges on login forms. D. Regular server restarts. Answer: Input validation on user inputs used in database queries. (A) Input validation helps ensure that user inputs cannot manipulate SQL queries. 9. What type of attack involves overwhelming a server to make it unavailable to legitimate users? A. Man-in-the-Middle attack. B. Phishing attack. C. Denial-of-Service (DoS) attack. D. Cross-Site Scripting (XSS) attack. Answer: Denial-of-Service (DoS) attack. (C) DoS attacks flood a server with traffic, denying access to genuine requests. 10. How does output encoding help improve web security? A. By creating stronger passwords. B. By automatically updating security patches. C. By reducing the risk of XSS attacks through the conversion of special characters. D. By encrypting database entries. Answer: By reducing the risk of XSS attacks through the conversion of special characters. (C) Output encoding minimizes the risk associated with executing malicious scripts. 11. What is the role of authentication and authorization in web security? A. To verify user identities and control access levels. B. To monitor network traffic for suspicious activity. C. To generate and distribute user passwords. D. To manage user sessions for improved user experience. Answer: To verify user identities and control access levels. (A) Authentication verifies identities while authorization defines access permissions. 12. Which of the following is NOT a recommended security measure for web applications? A. Regular updates and patching of software. B. Using firewalls to prevent unauthorized access. C. Encouraging users to share passwords. D. Following secure coding practices. Answer: Encouraging users to share passwords. (C) Encouraging users to share passwords is not a security measure and poses significant risks. 13. What type of attack employs deceptive emails to trick users into revealing personal information? A. Denial-of-Service attack. B. Phishing attack. C. Cross-Site Scripting attack. D. Man-in-the-Middle attack. Answer: Phishing attack. (B) Phishing attacks use fraudulent communications to capture sensitive user data.