1What is the primary definition of Session Hijacking?
A.Unauthorized encrypted communication between two servers
B.The exploitation of a valid computer session to gain unauthorized access to information or services
C.Crashing a web server by sending too many requests
D.Phishing a user to obtain their login credentials via email
Correct Answer: The exploitation of a valid computer session to gain unauthorized access to information or services
Explanation:Session hijacking involves an attacker taking over an active session between a user and a server after the user has authenticated.
Incorrect! Try again.
2Which of the following is a key difference between Session Hijacking and IP Spoofing?
A.IP Spoofing takes over an active session; Hijacking initiates a new one
B.Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
C.Session Hijacking only works on UDP; IP Spoofing works on TCP
D.There is no difference; they are synonymous
Correct Answer: Session Hijacking takes over an ongoing authenticated session; IP Spoofing creates unauthorized packets with a false source IP
Explanation:Hijacking relies on an existing valid session state, whereas spoofing is simply masking the source address, often to initiate a connection or hide identity.
Incorrect! Try again.
3In the context of TCP Session Hijacking, what must an attacker successfully predict to inject packets?
A.The MAC address
B.The Sequence Number (SEQ)
C.The User ID
D.The DNS server IP
Correct Answer: The Sequence Number (SEQ)
Explanation:To inject data into a TCP stream, the attacker must correctly predict the next sequence number expected by the target machine.
Incorrect! Try again.
4What is 'Session Fixation'?
A.An attack where the attacker fixes the server errors
B.An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
C.A defense mechanism to keep sessions stable
D.A method of fixing a static IP address to a session
Correct Answer: An attack where the attacker sets a user's session ID to one known to the attacker before the user logs in
Explanation:In session fixation, the attacker forces the victim to use a specific session ID, allowing the attacker to hijack the session once the user authenticates.
Incorrect! Try again.
5Which attack vector is commonly used to steal Session IDs stored in cookies?
A.SQL Injection
B.Cross-Site Scripting (XSS)
C.Buffer Overflow
D.Ping of Death
Correct Answer: Cross-Site Scripting (XSS)
Explanation:XSS allows attackers to execute malicious scripts in the victim's browser, which can access document.cookie and send the Session ID to the attacker.
Incorrect! Try again.
6Which of the following acts as a countermeasure against Session Hijacking by encrypting data in transit?
A.Using Telnet
B.Using SSL/TLS (HTTPS)
C.Using simple HTTP
D.Disabling cookies
Correct Answer: Using SSL/TLS (HTTPS)
Explanation:HTTPS encrypts the communication channel, making it difficult for attackers to sniff session IDs or tokens from the network traffic.
Incorrect! Try again.
7What is the purpose of the 'HttpOnly' flag in a Set-Cookie header?
A.To ensure the cookie is only sent over HTTP, not HTTPS
B.To prevent client-side scripts (like JavaScript) from accessing the cookie
C.To ensure the cookie expires immediately
D.To allow the cookie to be shared across different domains
Correct Answer: To prevent client-side scripts (like JavaScript) from accessing the cookie
Explanation:The HttpOnly flag mitigates the risk of XSS attacks stealing session cookies by blocking JavaScript access to them.
Incorrect! Try again.
8In a Man-in-the-Middle (MITM) attack used for session hijacking, what tool is often used to manipulate the ARP cache?
A.Nmap
B.ARP Spoofing/Poisoning
C.Ping
D.Traceroute
Correct Answer: ARP Spoofing/Poisoning
Explanation:ARP Spoofing associates the attacker's MAC address with the legitimate IP address of the gateway or victim, redirecting traffic through the attacker.
Incorrect! Try again.
9Passive Session Hijacking involves:
A.Injecting malicious packets into the stream
B.Monitoring and capturing traffic without altering it
C.Resetting the connection
D.Crashing the server
Correct Answer: Monitoring and capturing traffic without altering it
Explanation:Passive hijacking implies sniffing the network to gather information (like credentials or session IDs) without actively disrupting or modifying the stream.
Incorrect! Try again.
10A good defensive strategy regarding Session IDs after a successful login is to:
A.Keep the same Session ID used before login
B.Regenerate a new Session ID
C.Use the user's username as the Session ID
D.Make the Session ID static for 24 hours
Correct Answer: Regenerate a new Session ID
Explanation:Regenerating the session ID upon authentication prevents session fixation attacks where the attacker knows the pre-login ID.
Incorrect! Try again.
11In the Client-Server relationship, which entity is responsible for initiating the request?
A.Server
B.Client
C.Database
D.Firewall
Correct Answer: Client
Explanation:The client (e.g., a web browser) initiates the communication by sending a request to the server.
Incorrect! Try again.
12Which HTTP method is generally considered less secure for transmitting sensitive data because parameters are shown in the URL?
A.POST
B.GET
C.HEAD
D.CONNECT
Correct Answer: GET
Explanation:GET requests append data to the URL query string, which remains in browser history and server logs, exposing sensitive data.
Incorrect! Try again.
13What is 'Directory Traversal' in the context of web server vulnerabilities?
A.Moving files from one folder to another
B.Accessing files outside the web root folder by manipulating input (e.g., ../)
C.Indexing the website on a search engine
D.Traversing the network topology
Correct Answer: Accessing files outside the web root folder by manipulating input (e.g., ../)
Explanation:Directory traversal exploits insufficient security validation of user-supplied input file names, allowing characters like '../' to access restricted parent directories.
Incorrect! Try again.
14Which of the following is a common vulnerability where a web application fails to properly filter user input before sending it to a database?
A.Denial of Service
B.SQL Injection
C.DNS Spoofing
D.Session Timeout
Correct Answer: SQL Injection
Explanation:SQL Injection occurs when untrusted user input is concatenated directly into database commands without validation or escaping.
Incorrect! Try again.
15Web Parameter Tampering involves:
A.Modifying data within form fields, URLs, or cookies to manipulate application behavior
B.Deleting web server logs
C.Changing the physical server hardware
D.Updating the web browser version
Correct Answer: Modifying data within form fields, URLs, or cookies to manipulate application behavior
Explanation:Attackers tamper with parameters (like price or user ID) sent from the client to the server to bypass logic or privilege checks.
Incorrect! Try again.
16Which tool is commonly used for vulnerability scanning of web applications?
A.Photoshop
B.Nikto or OWASP ZAP
C.Microsoft Word
D.Windows Media Player
Correct Answer: Nikto or OWASP ZAP
Explanation:Nikto and OWASP ZAP are widely used tools designed to scan web servers and applications for known vulnerabilities and misconfigurations.
Incorrect! Try again.
17Why are hidden form fields dangerous if not validated by the server?
A.They slow down the website
B.They make the HTML code messy
C.Users can view source, modify the hidden values, and submit them
D.They cannot be seen by the browser
Correct Answer: Users can view source, modify the hidden values, and submit them
Explanation:Hidden fields are just HTML text. An attacker can save the page, edit the hidden value (e.g., setting a product price to zero), and submit the form.
Incorrect! Try again.
18What does SQL stand for?
A.Structured Question Language
B.Structured Query Language
C.Simple Query Logic
D.Standard Query List
Correct Answer: Structured Query Language
Explanation:SQL stands for Structured Query Language, the standard language for managing relational databases.
Incorrect! Try again.
19The core root cause of SQL Injection vulnerabilities is:
A.The database is too slow
B.The web server is running Linux
C.Trusting user input and mixing code with data
D.Using a firewall
Correct Answer: Trusting user input and mixing code with data
Explanation:SQLi happens when the interpreter cannot distinguish between the intended code (the query) and the data provided by the user.
Incorrect! Try again.
20In a SQL Injection attack, what is the significance of the single quote (') character?
A.It starts a comment
B.It is used to delimit strings; inserting it can break the query structure
C.It deletes the database
D.It encrypts the password
Correct Answer: It is used to delimit strings; inserting it can break the query structure
Explanation:Attackers use the single quote to close a data field in the code and begin injecting their own SQL commands.
Incorrect! Try again.
21What does the injection OR 1=1 typically achieve in a login bypass attack?
A.It causes a syntax error
B.It creates a condition that is always true, bypassing the password check
C.It sets the password to 1
D.It deletes the user account
Correct Answer: It creates a condition that is always true, bypassing the password check
Explanation:Since 1 always equals 1, the database evaluates the condition as true, often returning the first record in the table (usually the admin).
Incorrect! Try again.
22Which SQL comment symbol is often used to ignore the remainder of the original query in MySQL?
A.//
B.<!-- -->
C.# or --
D.%%
Correct Answer: # or --
Explanation:In MySQL, # or -- (dash-dash-space) comments out the rest of the query, effectively neutralizing password checks or other logic.
Incorrect! Try again.
23What is 'Blind SQL Injection'?
A.An attack where the attacker cannot see the screen
B.An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
C.An attack where the database is offline
D.An attack using invisible ink
Correct Answer: An attack where the database does not return data/errors to the screen, so the attacker infers data based on server behavior
Explanation:In Blind SQLi, the attacker sends True/False questions to the DB and observes the response (time delay or content change) to extract data byte-by-byte.
Incorrect! Try again.
24Which SQL command is most dangerous regarding data loss if injected successfully?
A.SELECT
B.DROP TABLE
C.UNION
D.INSERT
Correct Answer: DROP TABLE
Explanation:DROP TABLE removes entire tables and their data from the database, causing significant data loss.
Incorrect! Try again.
25What is a UNION-based SQL injection?
A.Joining two databases physically
B.Using the UNION operator to combine the results of the original query with the results of an injected query
C.Creating a labor union for DBAs
D.Injecting into the Union Bank website
Correct Answer: Using the UNION operator to combine the results of the original query with the results of an injected query
Explanation:UNION allows an attacker to append the results of their own malicious SELECT query to the results of the legitimate query, displaying data on the page.
Incorrect! Try again.
26What is the most effective defense against SQL Injection?
Explanation:Parameterized queries ensure the database treats user input as data, not as executable code, strictly separating the two.
Incorrect! Try again.
27How does 'Error-based SQL Injection' help an attacker?
A.It crashes the server immediately
B.It provides details about the database structure via verbose error messages
C.It fixes errors in the code
D.It creates a backup of the database
Correct Answer: It provides details about the database structure via verbose error messages
Explanation:Attackers intentionally cause errors; if the application displays raw DB errors, it reveals table names, column types, or logic structures.
Incorrect! Try again.
28Which technique allows an attacker to evade basic pattern-matching detection systems (IDS) during SQL injection?
A.URL Encoding or Hex Encoding
B.Writing the query in capital letters
C.Using a faster internet connection
D.Sending the query via email
Correct Answer: URL Encoding or Hex Encoding
Explanation:Encoding malicious characters (like replacing ' with %27) can sometimes bypass simple signature-based filters that look for specific plain-text strings.
Incorrect! Try again.
29What is the 'Principle of Least Privilege' in the context of database security?
A.Giving every user admin rights
B.Ensuring the database application connects with an account that has only the minimum necessary permissions
C.Blocking all users from the database
D.Using the oldest version of SQL
Correct Answer: Ensuring the database application connects with an account that has only the minimum necessary permissions
Explanation:If the web app connects as 'sa' or 'root', an injection can destroy the whole DB. Least privilege limits the damage an attacker can do.
Incorrect! Try again.
30What is the role of a Web Application Firewall (WAF) regarding SQL Injection?
A.It fixes the code automatically
B.It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
C.It encrypts the database
D.It creates user backups
Correct Answer: It inspects incoming HTTP traffic and blocks patterns that look like SQL injection attacks
Explanation:A WAF sits in front of the web server and filters malicious traffic based on rulesets, acting as a shield against known attack patterns.
Incorrect! Try again.
31When testing for SQL injection, what is 'Fuzzing'?
A.Cleaning the screen
B.Sending random, invalid, or unexpected data to inputs to see how the application reacts
C.Encrypting the connection
D.Downloading the database
Correct Answer: Sending random, invalid, or unexpected data to inputs to see how the application reacts
Explanation:Fuzzing involves automatic injection of unexpected data (like special characters) to find crash points or error messages indicating vulnerabilities.
Incorrect! Try again.
32Which of the following represents a 'Time-based' Blind SQL Injection?
A.WAITFOR DELAY '0:0:10'
B.SELECT * FROM Users
C.DROP TABLE Users
D.UNION ALL SELECT
Correct Answer: WAITFOR DELAY '0:0:10'
Explanation:This command instructs the database to pause for 10 seconds. If the page takes 10 seconds to load, the attacker knows their injection was executed.
Incorrect! Try again.
33In a web application, what is Input Validation?
A.Ensuring input data meets expected criteria (type, length, format) before processing
B.Validating that the keyboard is connected
C.Checking if the user is an admin
D.Validating the server license
Correct Answer: Ensuring input data meets expected criteria (type, length, format) before processing
Explanation:Input validation checks if the data is what the application expects (e.g., ensuring an 'age' field is only a number), reducing attack surface.
Incorrect! Try again.
34What is the danger of enabling 'xp_cmdshell' in MS SQL Server?
A.It slows down queries
B.It allows the execution of Operating System commands via SQL
C.It prevents tables from being created
D.It changes the language to Spanish
Correct Answer: It allows the execution of Operating System commands via SQL
Explanation:xp_cmdshell allows SQL Server to spawn a command shell. If an attacker injects into this, they can take control of the OS, not just the DB.
Incorrect! Try again.
35Which character is often used to chain multiple SQL queries together in a single injection (Stacking Queries)?
A.Comma (,)
B.Semicolon (;)
C.Colon (:)
D.Period (.)
Correct Answer: Semicolon (;)
Explanation:The semicolon terminates a SQL statement. In databases that support stacked queries, an attacker can end the first query and start a new malicious one using ';'.
Incorrect! Try again.
36What is Whitespace Manipulation in the context of evading SQLi detection?
A.Deleting all spaces in the code
B.Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
C.Adding spaces to make the website look better
D.Using a larger monitor
Correct Answer: Replacing spaces with other whitespace characters (like tabs or newlines) to bypass filters
Explanation:If a filter blocks 'SELECT ', an attacker might write 'SELECT[tab]' or 'SELECT/*/ ' to bypass the filter while keeping valid SQL syntax.
Incorrect! Try again.
37Which of the following is an example of an 'In-band' SQL Injection?
A.The attacker uses a different channel to retrieve data
B.The data is retrieved using the same channel (e.g., displayed on the webpage)
C.The attack is performed over the phone
D.The attack relies solely on time delays
Correct Answer: The data is retrieved using the same channel (e.g., displayed on the webpage)
Explanation:In-band SQLi (like UNION-based or Error-based) returns the results directly in the application's response to the attacker.
Incorrect! Try again.
38What is a 'stored' SQL injection?
A.The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
B.The injection is stored on a USB drive
C.The injection only happens once
D.The code is stored in the browser cache
Correct Answer: The malicious code is permanently stored in the database (e.g., in a forum post) and executes later
Explanation:Stored SQLi involves placing malicious input into the DB (like a comment field). It executes whenever the application retrieves and processes that data.
Incorrect! Try again.
39To secure cookies against session hijacking, the 'Secure' flag should be set to:
A.Ensure cookies are sent only over encrypted (HTTPS) connections
B.Make the cookie invisible
C.Encrypt the cookie content with ROT13
D.Allow the cookie on HTTP only
Correct Answer: Ensure cookies are sent only over encrypted (HTTPS) connections
Explanation:The Secure flag prevents the browser from sending the cookie over an unencrypted HTTP connection, protecting it from network sniffing.
Incorrect! Try again.
40Which of these is NOT a valid method to test for SQL Injection?
A.Inputting a single quote into a search box
B.Inputting 1=1 logic
C.Running a vulnerability scanner
D.Physical inspection of the server hard drive
Correct Answer: Physical inspection of the server hard drive
Explanation:Physical inspection does not reveal software logic vulnerabilities like SQL injection.
Incorrect! Try again.
41In a client-server architecture, where should security validation be most rigorously applied?
A.Client-side only (JavaScript)
B.Server-side
C.Neither
D.On the router only
Correct Answer: Server-side
Explanation:Client-side validation can be bypassed easily (e.g., disabling JS). The server must always validate data before processing it.
Incorrect! Try again.
42How can 'Stored Procedures' help prevent SQL Injection?
A.They make the database slower
B.They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
C.They delete all data periodically
D.They encrypt the hard drive
Correct Answer: They encapsulate queries and can accept parameters, functioning similarly to parameterized queries
Explanation:When used correctly with parameters, stored procedures define the SQL logic beforehand, preventing user input from altering the query structure.
Incorrect! Try again.
43What does an attacker typically look for in a URL to attempt SQL Injection?
A.Images (.jpg)
B.CSS files
C.Query strings with parameters (e.g., ?id=5)
D.Static HTML pages
Correct Answer: Query strings with parameters (e.g., ?id=5)
Explanation:Parameters passed in the URL (GET requests) are common vectors for injection if those parameters are used directly in a DB query.
Incorrect! Try again.
44Which of the following best describes 'Session Timeout' as a defensive strategy?
A.Closing the session automatically after a period of inactivity
B.Slowing down the internet connection
C.Banning the user forever
D.Turning off the server at night
Correct Answer: Closing the session automatically after a period of inactivity
Explanation:Session timeouts reduce the window of opportunity for an attacker to hijack a session if a user walks away without logging out.
Incorrect! Try again.
45What is the risk of having 'Verbose Error Messages' enabled on a live production server?
A.It looks unprofessional
B.It aids attackers in understanding the technology stack and database structure (Information Leakage)
C.It uses too much bandwidth
D.It fills up the hard drive
Correct Answer: It aids attackers in understanding the technology stack and database structure (Information Leakage)
Explanation:Detailed errors give attackers a roadmap of the internal workings, table names, and syntax required to exploit the system.
Incorrect! Try again.
46Why is 'Allow-listing' (White-listing) input validation superior to 'Block-listing' (Black-listing)?
A.It is faster to write
B.Block-listing often fails because attackers can find variations or encodings that aren't on the list
C.Allow-listing accepts everything
D.Block-listing is illegal
Correct Answer: Block-listing often fails because attackers can find variations or encodings that aren't on the list
Explanation:Allow-listing only accepts known good input. Block-listing attempts to block known bad input, which is impossible to do comprehensively.
Incorrect! Try again.
47In network session hijacking, what is 'Ack Storm'?
A.A weather condition affecting Wi-Fi
B.A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
C.A hacking tool
D.A type of firewall
Correct Answer: A burst of traffic caused by desynchronized sequence numbers where devices repeatedly try to synchronize
Explanation:When an attacker hijacks a TCP session, the victim and server get out of sync. They endlessly send ACKs to try to re-sync, causing an 'Ack Storm'.
Incorrect! Try again.
48Using an ORM (Object-Relational Mapping) framework generally reduces SQL injection risks because:
A.It doesn't use SQL
B.It automatically uses parameterized queries under the hood
C.It uses a special firewall
D.It requires biometric authentication
Correct Answer: It automatically uses parameterized queries under the hood
Explanation:Modern ORMs handle database interaction via objects and usually abstract away raw SQL generation, defaulting to safe parameterization.
Incorrect! Try again.
49Which header helps protect against clickjacking, which can be related to session manipulation?
A.X-Frame-Options
B.Content-Type
C.Host
D.User-Agent
Correct Answer: X-Frame-Options
Explanation:X-Frame-Options (or CSP frame-ancestors) prevents the site from being loaded in an iframe, stopping attackers from overlaying hidden frames to trick users.
Incorrect! Try again.
50When an attacker uses HAVING 1=1 in an injection, they are often trying to:
A.Delete the table
B.Force an error to reveal the table or column name in the error message
C.Login as admin
D.Speed up the query
Correct Answer: Force an error to reveal the table or column name in the error message
Explanation:The HAVING clause requires a GROUP BY clause in most SQL dialects. Injecting it without one forces a syntax error that often reveals the current column/table name.
Incorrect! Try again.
Give Feedback
Help us improve by sharing your thoughts or reporting issues.