PenTest+ Web Application Vulnerability Discovery Quiz

1. In API security testing, what vulnerability occurs when sensitive data is exposed in API responses?

Excessive data exposure

API rate limiting

Request validation

Token expiration

2. Which vulnerability assessment activity involves documenting all discovered flaws with severity ratings and remediation recommendations?

Reporting

Scanning

Enumeration

Exploitation

3. In web application testing, what does a subdomain takeover vulnerability enable?

An attacker to claim and control an unused subdomain via DNS misconfiguration

Access to the main domain administrator account

Encryption of all user passwords

Automatic malware installation

4. What is the primary purpose of security headers like Content-Security-Policy?

Mitigate XSS and injection attacks by controlling resource loading

Encrypt all network traffic

Authenticate user sessions

Prevent DDoS attacks exclusively

5. Which vulnerability class affects applications that fail to validate file types during upload?

Unrestricted file upload

Weak encryption

Poor session management

Inadequate logging

6. In vulnerability analysis, what does CVSS scoring measure?

The severity and exploitability of a vulnerability

The cost of fixing a vulnerability

The number of affected users

The patching timeline required

7. What vulnerability allows attackers to execute arbitrary commands on a server through user input?

OS command injection

Buffer overflow

Format string attack

Integer overflow

8. Which HTTP header can be manipulated to conduct a Host Header Injection attack?

Host header

Accept-Encoding

User-Agent

Cache-Control

9. What is a race condition in web application security?

A timing vulnerability where two concurrent operations produce unexpected results

An error in database indexing

A network bandwidth limitation

A type of denial-of-service attack only

10. Which vulnerability assessment phase involves mapping the application architecture and identifying entry points?

Reconnaissance

Exploitation

Reporting

Remediation

11. Which HTTP method is most commonly exploited when testing for Cross-Site Request Forgery (CSRF) vulnerabilities?

GET requests only

POST, PUT, and DELETE requests

HEAD requests

OPTIONS requests

12. What does a security misconfiguration vulnerability typically result from?

Default settings, incomplete installations, or unnecessary features left enabled

Only malicious insider actions

Hardware failures exclusively

Network latency issues

13. Which tool is commonly used for automated web application scanning and vulnerability discovery?

Burp Suite

Wireshark

Metasploit

Nmap

14. What vulnerability allows an attacker to bypass business logic by manipulating parameter values?

Broken access control

Insecure direct object references (IDOR)

Race conditions

XML external entity (XXE) injection

15. In path traversal testing, what does the sequence '../' typically represent?

Moving up one directory level in the file system

Accessing encrypted files

Listing hidden system processes

Requesting the root domain

16. Which authentication bypass technique exploits weak password policies or default credentials?

Credential stuffing

Session hijacking

Token manipulation

Man-in-the-middle attacks

17. What is the primary risk of an insecure deserialization vulnerability?

Remote code execution through malicious object instantiation

Loss of data encryption

Temporary service disruption only

Reduced application performance

18. Which vulnerability assessment technique involves sending specially crafted input to identify how an application handles unexpected data?

Fuzzing

Scanning

Enumeration

Fingerprinting

19. In SQL injection testing, what does the UNION-based technique allow an attacker to do?

Combine results from multiple database queries

Delete entire database tables

Encrypt database contents

Bypass authentication without credentials

20. What is the primary difference between a reflected XSS and a stored XSS vulnerability?

Reflected XSS requires user interaction; stored XSS persists in the database

Stored XSS only affects the attacker's browser

Reflected XSS is more dangerous than stored XSS

There is no practical difference between them