CPSA Crest 3 — Questions and Answers
Question 1: What is the primary defense against Cross-Site Request Forgery (CSRF) attacks in web applications?
- Input validation on all form fields
- Synchronizer token pattern using unpredictable CSRF tokens (Correct answer)
- Enforcing HTTPS on all pages
- Setting the HttpOnly flag on session cookies
Correct answer: Synchronizer token pattern using unpredictable CSRF tokens
Anti-CSRF tokens are unique, unpredictable values tied to user sessions that must be submitted with each state-changing request, preventing forged requests.
Question 2: Which HTTP response header instructs browsers to prevent MIME-type sniffing, reducing XSS risk from uploaded files?
- X-Frame-Options
- Content-Security-Policy
- X-Content-Type-Options (Correct answer)
- Strict-Transport-Security
Correct answer: X-Content-Type-Options
X-Content-Type-Options: nosniff prevents browsers from interpreting files as a different MIME type than declared, mitigating attacks via content-type confusion.
Question 3: During a web application test, you find that changing the order ID in a URL reveals another user's order. What vulnerability is this?
- Broken Authentication
- Insecure Direct Object Reference (IDOR) (Correct answer)
- Security Misconfiguration
- Server-Side Request Forgery (SSRF)
Correct answer: Insecure Direct Object Reference (IDOR)
IDOR occurs when an application uses user-controlled input to access objects directly without verifying the requesting user's authorization.
Question 4: What does a Blind SQL injection vulnerability differ from a classic SQL injection in terms of exploitation?
- Blind SQLi only works against MySQL databases
- Blind SQLi does not return query results directly; data is inferred from application behavior (Correct answer)
- Blind SQLi requires authentication to exploit
- Blind SQLi can only delete data, not retrieve it
Correct answer: Blind SQLi does not return query results directly; data is inferred from application behavior
In blind SQL injection, the attacker cannot see query output directly and must infer information from differences in application responses or timing.
Question 5: Which encoding technique is most effective at preventing reflected XSS when inserting user input into HTML content?
- URL encoding
- HTML entity encoding (Correct answer)
- Base64 encoding
- Unicode normalization
Correct answer: HTML entity encoding
HTML entity encoding converts characters like <, >, and & into their HTML entities, preventing browsers from interpreting injected content as executable markup.
Question 6: What is the security risk of storing sensitive data in the browser's localStorage?
- Data is automatically sent to third-party domains
- Data persists after browser close and is accessible to any JavaScript on the origin (Correct answer)
- Data is encrypted but with a weak algorithm
- Data is included in HTTP headers on every request
Correct answer: Data persists after browser close and is accessible to any JavaScript on the origin
localStorage data has no expiry, persists across sessions, and is accessible to any JavaScript running on the same origin, making XSS attacks able to exfiltrate sensitive tokens.
Question 7: When testing for Server-Side Template Injection (SSTI), which payload is commonly used to identify a vulnerable endpoint?
- ' OR 1=1--
- {{7*7}} (Correct answer)
- <script>alert(1)</script>
- ; ls -la
Correct answer: {{7*7}}
Submitting {{7*7}} tests whether a template engine evaluates the expression; if the response contains 49, the input is being processed as a template.
CPSA Crest 3
What is the primary defense against Cross-Site Request Forgery (CSRF) attacks in web applications?