GPEN Web Application Penetration Testing Quiz

1. Broken access control allows users to access resources beyond their authorization level. True or False?

True

False

2. Which phase of penetration testing involves gathering information about the target application?

Exploitation

Reporting

Reconnaissance

Remediation

Submit

4. Server-side request forgery (SSRF) allows attackers to make requests from the server itself. True or False?

True

False

5. Which encryption standard is recommended for securing data in transit over HTTPS?

DES

TLS 1.2 or higher

MD5

SHA-1

Submit

7. Content Security Policy (CSP) is a security mechanism that prevents XSS attacks. True or False?

True

False

8. Which of these is NOT a common web application vulnerability according to OWASP Top 10?

Broken authentication

Insecure deserialization

Hardware malfunction

Security misconfiguration

Submit

10. Which HTTP status code indicates that a resource requires authentication?

403 Forbidden

401 Unauthorized

404 Not Found

500 Internal Server Error

11. Which HTTP method is most commonly exploited in cross-site request forgery (CSRF) attacks?

GET

POST

HEAD

OPTIONS

12. What is the primary goal of conducting a security assessment on a web application?

To shut down the application

To identify and document vulnerabilities before attackers do

To steal sensitive user data

To modify the application's source code

13. Which tool is commonly used to intercept and modify HTTP requests during web application testing?

Burp Suite

Wireshark

Nmap

Metasploit

Submit

15. In a reflected XSS attack, the malicious script is stored in the web server's database. True or False?

True

False

16. What does the same-origin policy (SOP) protect against?

Unauthorized file uploads

Cross-domain script execution

Brute force password attacks

Man-in-the-middle interception

17. Cross-site scripting (XSS) attacks allow attackers to inject malicious scripts. True or False?

True

False

18. Which of the following is a valid technique for detecting SQL injection flaws?

Time-based blind SQL injection testing

Network packet analysis only

Reverse engineering source code

Social engineering the database administrator

Submit

20. What is the primary purpose of input validation in web application security?

Encrypt sensitive data

Prevent malicious code injection

Authenticate user identity

Log all user activities

GPEN Web Application Penetration Testing Quiz

1. Broken access control allows users to access resources beyond their authorization level. True or False?

2.

What first name or nickname would you like us to use?

2. Which phase of penetration testing involves gathering information about the target application?

3. When testing for vulnerabilities, a penetration tester must obtain written ____ before beginning.

4. Server-side request forgery (SSRF) allows attackers to make requests from the server itself. True or False?

5. Which encryption standard is recommended for securing data in transit over HTTPS?

6. A successful penetration test should include proper documentation and a detailed ____.

7. Content Security Policy (CSP) is a security mechanism that prevents XSS attacks. True or False?

8. Which of these is NOT a common web application vulnerability according to OWASP Top 10?

9. Path traversal vulnerabilities enable attackers to access files outside the intended ____.

10. Which HTTP status code indicates that a resource requires authentication?

11. Which HTTP method is most commonly exploited in cross-site request forgery (CSRF) attacks?

12. What is the primary goal of conducting a security assessment on a web application?

13. Which tool is commonly used to intercept and modify HTTP requests during web application testing?

14. Authentication bypass vulnerabilities can be exploited by manipulating ____.

15. In a reflected XSS attack, the malicious script is stored in the web server's database. True or False?

16. What does the same-origin policy (SOP) protect against?

17. Cross-site scripting (XSS) attacks allow attackers to inject malicious scripts. True or False?

18. Which of the following is a valid technique for detecting SQL injection flaws?

19. SQL injection vulnerabilities occur when user input is not properly ____.

20. What is the primary purpose of input validation in web application security?